Michael J. Berger & Co. Notifies Individuals After Ransomware Incident

Key Takeaways

• Michael J. Berger & Co., CPA LLP reportedly notified affected individuals in October 2026 about a ransomware incident involving unauthorized network access that began on September 17, 2025.
• Potentially exposed information may include Social Security numbers, financial-account details, names, addresses, dates of birth, and government identification data.
• The incident highlights the security and legal risks facing accounting and professional-services businesses that retain sensitive client records.

Michael J. Berger & Co., CPA LLP reportedly began notifying affected individuals in October 2026 following an investigation into a ransomware incident. Unauthorized access to the accounting firm's network began on September 17, 2025, according to reports concerning the notification.

The potentially affected records may have contained names, addresses, dates of birth, Social Security numbers, financial-account information, and government identification data. The precise information involved can vary by individual, so recipients should consult their notification letters and confirm the details against the relevant Vermont Attorney General filing before taking action.

Dapeer Law opened an investigation into the matter on October 28, 2026. That investigation is separate from the forensic and legal work undertaken by Michael J. Berger & Co., CPA LLP, and its involvement does not by itself establish liability or damages.

Still, the reported data categories make this more than a routine system outage. Social Security numbers and government identification details can remain useful to criminals long after passwords are changed. Financial-account information creates another layer of exposure, particularly if stolen records can be combined with addresses, birth dates, or other identity attributes.

Accounting firms hold unusually concentrated collections of valuable information. Their systems may contain tax documents, payroll records, banking instructions, identification materials, and business correspondence. A single network intrusion can therefore affect employees, clients, vendors, and other people whose information appears in client files.

The incident also fits a wider pattern across professional services. The Privacy Rights Clearinghouse counted 113 breach events involving law firms and legal-services providers during the first half of 2026, up from 64 in the first half of 2022. The sector's share of recorded events increased from 3.8% to 5.7% over that period. While accounting and legal practices are distinct, both depend heavily on confidential records and trusted client communications.

Threat methods are varied, too. BakerHostetler reviewed more than 1,250 incidents handled during 2025 and found that network intrusions represented 47%, while email compromise accounted for 32%. Data exfiltration or theft appeared in 48% of the incidents, ransomware in 27%, and wire or direct-deposit fraud in 13%. Lawsuits followed 14% of disclosed incidents.

Those figures matter for finance-focused businesses because ransomware is often only one part of the event. Attackers may steal files before encrypting systems, use compromised mailboxes to redirect payments, or impersonate employees and clients. Was data merely accessed, or was it copied and later misused? That distinction can take considerable forensic work to resolve.

Michael J. Berger & Co., CPA LLP reportedly used HaystackID for identity-theft services connected with the response. Affected individuals should rely on the enrollment instructions in an authentic notice rather than unsolicited emails or calls. Criminals sometimes exploit public breach announcements through follow-on phishing campaigns, making verification particularly important.

The scale of notification activity is not limited to the United States. DLA Piper reported that European personal-data-breach notifications averaged 443 per day during the year ending January 27, 2026, a 22% annual increase. Different jurisdictions impose different reporting requirements, but the trajectory reinforces a common operational concern: incident response now involves technical containment, record review, regulatory analysis, communications, and potential litigation.

For accounting executives, the practical lesson is broader than deploying another security product. Firms can reduce exposure by limiting retained data, restricting administrative access, separating critical systems, strengthening email authentication, testing backups, and rehearsing response procedures with legal and forensic teams. Vendor access deserves scrutiny as well.

Affected recipients, meanwhile, may consider monitoring financial accounts and credit reports, placing fraud alerts or credit freezes where appropriate, and watching for tax or benefits fraud. The notification letter and official regulatory filing should guide the response. Fast action helps, but accurate verification comes first.