Forrestall CPAs data breach: 60,843 people after files were taken in December 2025

What happened in the Forrestall CPAs breach?

The letter says the firm found an incident involving unauthorized access to some of its systems, secured them, and brought in a cybersecurity firm. The investigation found that between December 22, 2025 and December 30, 2025 an unauthorized individual viewed and obtained certain files on its network. The firm says it notified law enforcement and has taken steps to further secure its systems. The letter does not say how the intruder got in, whether it was ransomware, or when the firm first noticed.

Date	What happened	Source
December 22, 2025	Start of the access window; breach date in Indiana's record	Letter; Indiana report
December 30, 2025	End of the access window	Letter; California list
August 7, 2026	Notice sent, per Indiana	Indiana report
August 17, 2026	Notice recorded by California	California list

California's list gives the breach dates as December 22 and December 30, 2025 and the reported date as August 17, 2026. From the end of the access window to the notice Indiana records is 220 days; the notice-delay guide shows how that compares.

Why would an accounting firm have my data?

Forrestall's letter does not say whose records were in the files, or whether the people it wrote to are its clients or people named in clients' files. The guide to why a CPA or advisory firm sent you a breach letter explains how other firms' notices answered that question, from the Mercadien and Aldrich letters.

What information was exposed?

The letter says the firm reviewed the files involved and found that one or more held the recipient's name and other data elements, which each letter lists. The public sample leaves that list blank, so this entry cannot say which types of data were involved for whom.

What is Forrestall offering people who got a letter?

A complimentary one-year membership of identity monitoring through Epiq, with an activation code and enrollment deadline on each letter. Questions go to 888-500-5670, Monday to Friday, 9 a.m. to 9 p.m. Eastern time. The firm's address on the letter is 4988 W Broad St NE, Sugar Hill, GA 30518. The guide to credit monitoring offers compares this offer with others in the log.

How many Texans were affected?

Texas's attorney general lists a report from Forrestall CPAs LLC, posted on August 21, 2026, with 3,725 Texans affected. The Texas record lists names, addresses, Social Security numbers, financial account or card numbers, health insurance information and dates of birth among the information involved. The Texas ranking lists 2026's largest reports. The figure counts Texans only.

What the record leaves open

• Which data types were in the files, and for how many people each.
• How the intruder got in, and when the firm first noticed.
• Whether the 60,843 are clients, their employees and dependants, or others.