Smith & James, CPAs experienced unauthorized access to its email environment on March 5, 2026, discovered on March 9, 2026. An unknown actor accessed and acquired personal information including names, Social Security numbers, dates of birth, medical information, and health insurance information. The firm engaged cybersecurity experts, secured its network, and notified the IRS. Affected individuals are offered 12 months of complimentary credit monitoring and identity theft protection.