Stephen F. McFadden CPA notified clients of a potential security incident in late April 2021 after receiving an IRS alert that a tax return had already been filed for a client. The firm engaged forensic investigators, who had not identified signs of data access or exfiltration at the time of notification. Affected data may include names, addresses, Social Security numbers, and bank account numbers. The investigation was ongoing, and the firm provided identity theft protection services.