Cipriani & Werner

Green Accounting & Tax LLC, a Creston, Iowa accounting firm, notified the Iowa Attorney General on August 13, 2026, of a data breach discovered on April 27, 2026. Unauthorized access affected 3,335 Iowa residents, exposing names, SSNs, driver’s license numbers, and financial account information. The firm engaged forensic investigators, notified law enforcement, and offered credit monitoring services.

Northwest Iowa Community College (NICC) notified the Iowa AG of a data security event. Unauthorized access occurred Nov 24-26, 2025. NICC discovered the activity on Nov 26, 2025. The incident potentially affected 16,004 Iowa residents, with names and Social Security numbers accessed. NICC engaged forensic specialists, secured its network, and began mailing notices on July 8, 2026, offering credit monitoring services.

Alta Orthopaedics Medical Group, Inc. notified the New Hampshire Attorney General of a data breach involving unauthorized network access between Feb 3-6, 2026, discovered March 10, 2026. Approximately 3 NH residents were affected. Data included names, DOB, SSN, driver's licenses, and medical/financial info. Response included password resets, law enforcement notification, and credit monitoring offers.

David Evans Enterprises, Inc. reported an external system breach (hacking) occurring Feb 26-27, 2026, discovered March 23, 2026. 8,915 individuals affected, including 4 Maine residents. Data included names and government identifiers. Notices sent April 10, 2026, offering 12 months of credit monitoring via TransUnion.

Evolve Mortgage Services, LLC reported an external system breach (hacking) occurring between September 17 and 24, 2025. The incident was discovered on March 13, 2026, affecting 13,501 individuals nationwide, including 25 Maine residents. Data types included names and government identifiers. Notices were sent starting February 25, 2026, offering 12 months of credit monitoring.

Unibail-Rodamco-Westfield reported unauthorized access to a database containing loyalty program and newsletter subscriber data for Westfield Southcenter. The incident occurred Feb 12-18, 2026, and was discovered on Feb 18. 5,723 Washington residents were notified on March 18, 2026. Data potentially included names and dates of birth.

Evolve Mortgage Services, LLC reported an external system breach (hacking) occurring between September 17 and 24, 2025, discovered on January 23, 2026. Approximately 4,309 individuals were affected, including 15 Maine residents. The breach involved personal identifiers and government IDs. Notices were sent in late February/early March 2026, offering 12 months of credit monitoring via TransUnion.

Barnhart Group, Inc. reported an external system breach (hacking) occurring between August 27-29, 2025. The incident was discovered on January 23, 2026, after a comprehensive data review. 1,435 individuals were affected, including 2 Maine residents. Only names were compromised. The company engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

KMS Solutions, LLC reported an external system breach (hacking) affecting 19 Maine residents. Unauthorized access occurred between Nov 27 and Dec 7, 2025, discovered on Dec 31, 2025. Compromised data included names, financial account info, and SSNs. Notices sent Jan 16, 2026, offering 12 months of credit monitoring via Experian.

Wood Personnel Services reported an external system breach (hacking) on September 12, 2025, affecting 1 Maine resident. The incident involved unauthorized access to files containing names. The company engaged third-party specialists for investigation and offered 12 months of credit monitoring and identity theft restoration services.

Sentry Advisors, LLC reported a data breach occurring on June 12, 2025, discovered on July 29, 2025. The incident affected 1,234 individuals, including 3 Maine residents. The breach involved the acquisition of personal identifiers. Affected individuals were notified on December 17, 2025, and offered 12 months of credit monitoring and identity theft protection services through Cyberscout/TransUnion.

Cove Risk Services, LLC reported a data breach affecting 49,385 individuals, including 182 Maine residents. Unauthorized access occurred May 3-5, 2025, discovered November 10, 2025. Compromised data included names, SSNs, DOBs, and addresses. The company engaged third-party specialists, contained the incident, and provided 12 months of credit monitoring.

LaBella Associates, a professional services firm, reported an external system breach (hacking) occurring on March 24, 2025. The incident was discovered on October 13, 2025, affecting 6,712 individuals total, including 179 Maine residents. Personal information potentially accessed included names combined with other personal identifiers. LaBella engaged forensic investigators, secured its network, and offered 12 months of credit monitoring via TransUnion. Notices were sent on November 12, 2025.

Pure Haven, LLC reported an external system breach (hacking) on September 2, 2025, discovered on September 5, 2025. The incident involved unauthorized access to an internal account, potentially exposing names and personal identifiers. 738 individuals were affected, including 17 Maine residents. The company reset passwords, engaged third-party investigators, and offered 12 months of credit monitoring.

Ellis Early Learning, Inc. experienced an external system breach (hacking) between Jan 10-14, 2025. Discovered July 2, 2025. 790 individuals affected, including 2 Maine residents. Data involved names combined with other personal identifiers. Notification sent Oct 9, 2025. Credit monitoring offered.

Sheheen, Hancock & Godwin, LLP. experienced a data breach where an unknown actor copied/downloaded files on April 8, 2025. Approximately 42,077 individuals' PII, including SSNs, driver's licenses, and health/financial data, was compromised. Notices were sent on September 25, 2025, offering credit monitoring.

Carus, LLC reported an external system breach (hacking) occurring on August 1, 2025, discovered on September 8, 2025. The incident affected 867 individuals, including 1 Maine resident. Personal information accessed included names and Social Security numbers. Carus engaged forensic investigators, secured its network, and offered 12 months of credit monitoring.

Minsait ACS, Inc. reported a data breach affecting 332 individuals, including 3 Maine residents. The incident occurred between March 26 and May 5, 2025, and was discovered on August 14, 2025. Notification was sent on September 19, 2025. Affected data included names and government identifiers. Cyberscout provided 12 months of credit monitoring.

Sauers Lopez Construction, Inc. reported unauthorized access to systems between May 22-30, 2024, discovered May 29, 2025. 485 individuals affected, including 1 Maine resident. Data involved names and other personal identifiers. The company engaged third-party specialists, secured systems, and offered 12 months of credit monitoring via IDX.

Ellis Medicine, a healthcare provider, notified 13,383 individuals (including 8 Maine residents) of a phishing incident involving unauthorized access to an employee email account. The breach occurred between January 17, 2025, and April 5, 2025, and was discovered on May 14, 2025. Ellis Medicine reset passwords, enabled MFA, engaged third-party investigators, and provided 12 months of credit monitoring services to affected individuals.

Kosmos Management LLC reported an external system breach (hacking) affecting 105 individuals, including 1 Maine resident. The incident involved unauthorized access to employee email accounts, potentially exposing names and Social Security numbers. The breach occurred between January 23 and 29, 2025, was discovered on February 4, 2025, and notification was sent on July 9, 2025. Affected individuals were offered 12 months of credit monitoring.

Lewy Body Dementia Association, Inc. reported an external system breach (hacking) on its payroll platform on April 23, 2025. The incident affected 70 individuals, including 1 Maine resident. Compromised data included names, Social Security numbers, and bank account information. The organization engaged forensic investigators and offered 12 months of Experian credit monitoring.

DC Safety Sales Co., Inc. reported an external system breach (hacking) exploiting a zero-day vulnerability in a third-party application. The incident occurred between Dec 11, 2024, and Jan 22, 2025, and was discovered on May 2, 2025. 116 individuals were affected, including 4 Maine residents. Data involved names and other personal identifiers. Remediation included isolating servers, engaging third-party specialists, and offering 24 months of Experian credit monitoring.

Health Care For All notified 60 individuals (including 1 Maine resident) of a breach involving an employee email account. Unauthorized access occurred between Sept 28 and Oct 17, 2024. The incident was discovered on March 12, 2025. Notifications were sent on May 9, 2025. Impacted data included names and potentially other personal identifiers. The organization reset passwords, engaged forensic specialists, and provided 24 months of credit monitoring.

Stewart Property Management, Inc. reported unauthorized access to an employee email account between Dec 3-13, 2024. The breach was discovered on March 10, 2025. 2,628 individuals were affected, including 120 Maine residents. The attacker likely gained access via phishing. Affected data included names and other personal identifiers. The company reset passwords, engaged forensic specialists, and offered 12 months of credit monitoring.