HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Mahoney & Gotto Company

bd_e78cb93b390474aa · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 1, 2025

Filed

Feb 4, 2026

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for Mahoney & Gotto Company →

Mahoney & Gotto Company notified Nebraska residents in February 2026 of a data incident discovered in April 2025. Unauthorized access to the firm's tax software system resulted in the exposure of client names, Social Security numbers, and bank account information. The firm engaged forensic professionals, isolated affected workstations, and offered 12 months of credit monitoring via Epiq.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 1, 2025

Discovered

Feb 4, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mahoney & Gotto Company
norm: mahoney gotto

Name: Mahoney & Gotto Company
norm: mahoney gotto
Industry: Professional Servicesllm

Discovered: Apr 1, 2025
Materiality determined: —
Notification sent: Feb 4, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported this Incident to the relevant government agenciescorresponding with the Internal Revenue Service and state tax authorities
Initial access: valid_credentials

During the incident: Changed passwords
Checking network security
Running malware scanners on its system
Isolating any potentially affected workstation
Corresponding with the Internal Revenue Service and state tax authorities
Engaging data security and privacy professionals for assistance
Offering complimentary access to Epiq - Privacy Solutions ID for twelve (12) months
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/5f0d7316-5288-410e-ae65-b7e1930cdf4f.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 4, 2026
Raw hash: b9508862a90f5361a8fcaf3f235c4f084d2af6a79ec78d15ca1bf9ac0173e3fa

Reporting entityMahoney & Gotto Company

Victim entityMahoney & Gotto Company

Incidentdiscovered Apr 1, 2025

Stated responseChanged passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov