Why a CPA or advisory firm sent you a breach letter: Mercadien, Aldrich, Opportune

Why a firm you never hired has your file

This guide reads three breach letters filed with the California Attorney General: Mercadien, P.C. CPAs, Aldrich Services LLP and Opportune LLP. It reports only what those letters say. Two of the three are quoted below on why the firm held the recipient's information.

Mercadien's letter says the firm serves financial institutions. The notice states that the firm provides accounting and advisory services to those institutions and obtained the recipient's information while doing that work.

Opportune's letter gives a similar explanation. It says the firm received the recipient's information while providing services to a client, and the client's name is blank in the sample copy.

In both cases the letter describes a provider holding data that came from another organization. The recipient may have no direct relationship with the firm that wrote to them.

What happened at each firm

The three letters describe different incidents, and each has its own dates.

Mercadien's letter gives the earliest date. It says the firm detected the incident on November 7, 2025 and took steps to remediate and contain it.

The letter says an outside investigation found that someone other than Mercadien had reached its files.

The letter also says Mercadien has no indication of misuse.

Aldrich's letter describes a narrower event. It says the firm became aware of suspicious activity related to one employee's email account.

The letter gives the access window as two days, saying the investigation determined that an unknown individual accessed the account between August 22, 2026 and August 23, 2026.

Opportune's letter points to its network. It says the impacted systems were first accessed on or about June 22, 2026 and held some of the recipient's personal information.

Which data the notices name

The sample letters on file are templates, and several data fields are placeholders or blanks. That limits what each one shows about Social Security numbers.

Mercadien's letter is the only one of the three that names the data in plain text. It says that on August 13, 2026 the firm determined the files included information it received from a financial institution (shown as the placeholder [Extra1]) in an advisory services engagement. The letter says that information included the recipient's name and Social Security number.

The letter adds that the exposure was on the firm's side. It says the incident occurred on Mercadien's network and did not affect the systems and files of the financial institution.

Aldrich's sample shows only half of its data list. It names "name" and then a placeholder for the second item, so the sample does not say which other data types were found.

Opportune's sample leaves its list blank in the same way. The sentence in the letter reads as follows, with the data types missing.

One caution about reading these letters. Social Security numbers appear in the Opportune letter's freeze instructions, which say that placing a security freeze requires the recipient to supply a name, address, date of birth and Social Security number. That is a requirement for the freeze, not a statement about what was exposed.

What each firm offers

All three firms offer credit monitoring. The length is a placeholder in each sample, so the number of months is not shown.

Mercadien offers free credit monitoring through Experian. The sample shows the term as "##" months.

The letter sets a deadline in two places. The main text says the recipient must enroll within 90 days from the date of the letter.

The additional-information pages give a calendar date. They say enrollment must happen by December 31, 2026, and that the code stops working after that date.

Aldrich also uses Experian. Its letter says the firm is offering complimentary credit monitoring, with the number of months shown as the placeholder [Extra3].

Aldrich's enrollment deadline falls later than Mercadien's. The letter says recipients must enroll by January 29, 2027, and that the code will not work afterward.

Opportune offers a different product. Its letter says the firm is offering complimentary Triple Bureau Credit Monitoring, which covers all three credit bureaus, and again leaves the number of months blank.

The Opportune letter names the company behind the service. It says Cyberscout, a TransUnion company, will provide the services.

What the letters leave open

Each letter is built around the same questions a recipient is likely to ask: why you got it, what data was involved and what the firm will do. The Mercadien letter answers the first two most directly. The Aldrich and Opportune samples in the record leave the data fields unfilled, so a reader of those samples cannot confirm from them whether a Social Security number was involved. A recipient holding an actual letter would see the filled-in version.

This guide stays inside the documents. It does not rank the firms, assign blame or judge how any of them handled the incident. For anything beyond what the letters state, the contact details printed in each letter are the place to go.