Frazer LLP, a CPA and consulting firm based in Anaheim, California, has filed data breach notices for a cybersecurity incident on March 24 and 25, 2025. It filed with the California Attorney General on October 16, 2026, and with other states including Massachusetts, according to Claim Depot. That puts notice about 570 days, or almost 19 months, after the intrusion. The ransomware group Qilin claimed the attack in late March 2025 and said it took about 69GB of data. Frazer's own notice letter confirms that personal data may have been acquired without authorization. It does not confirm Qilin's involvement or the 69GB figure. The firm has not said how many people are affected, and California does not publish counts of affected residents.
What Happened
Frazer's sample notice letter is on file with the California AG and summarized by AcidPeak and Class Action U. It says that on or about March 25, 2025, the firm had a cybersecurity incident that "impacted connectivity" to its network. Frazer says it started investigating right away with outside cybersecurity professionals. After what it calls an extensive forensic investigation and document review, it determined on September 18, 2026 that personal data may have been accessed between March 24 and 25, 2025. Notices went out about four weeks after that.
The ransomware link comes from third parties, not the firm. Claim Depot reports that Qilin posted Frazer on its Tor leak site, claimed 69GB of data, and threatened to publish it on April 8, 2025. Emery Reddy credits the same claim to the breach tracker Breachsense. It adds that Frazer has not publicly confirmed the Qilin claim and that the claim has not been independently verified. Claim Depot calls the incident a ransomware attack outright. The firm's description of a connectivity outage fits ransomware, but the letter does not say so.
Sources also differ on where Frazer filed. Most mention only California. Claim Depot lists notices to the attorneys general of California, Iowa, Maine, Montana, Nebraska, New Hampshire and Oregon, plus the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR). That suggests affected clients live in several states.
Frazer has operated since 1918 and has a second office in Visalia. It provides audit, tax and advisory services to businesses, farms, dairies, organizations and individuals, with a focus on agriculture, dairy and real estate.
What Was Taken
The public record is thin, and the sources do not agree:
- Volume: Qilin claims about 69GB (Claim Depot, Breachsense via Emery Reddy). Frazer has not confirmed a volume.
- Data types: Claim Depot says full names and Social Security numbers are the confirmed exposed fields. Class Action U says the public sample letter shows full names and that the other data elements are redacted. DataBreachRights says the data types have not been publicly disclosed.
- Broader lists: DataBreachLawCenter lists dates of birth, tax return information, wage and compensation data, direct deposit details, financial account numbers, and home and email addresses as possibly exposed. Claim Depot's sidebar lists medical, financial and government ID categories. Neither source ties these lists to specific text in Frazer's filing. Read them as possibilities, not confirmed findings.
- People affected: No source reports a count.
What is reasonably well supported is names plus Social Security numbers. Because Frazer is a tax and audit practice, client files it holds would typically also include tax returns and banking details. No source confirms that those were taken.
Why It Matters
The notification delay is the main story. The intrusion was noisy: connectivity was disrupted, and a public extortion claim was posted within days. Even so, Frazer took about 18 months to decide whose data was involved. During that time, any data Qilin published was available to criminals while clients knew nothing and could not freeze their credit or file for an IRS Identity Protection PIN. Long document reviews after a large data theft are common. Taking 18 months to finish one is a weakness that regulators and plaintiffs' firms are now paying attention to, and several law firms are already advertising investigations.
Accounting firms are good targets for Qilin. Mid-sized CPA practices hold dense, very usable personal data: SSNs, tax returns, W-2s and direct deposit details. Their security budgets are often far smaller than those of the banks and insurers whose data they handle. Stolen tax data supports fraudulent tax filings as well as standard identity theft.
Leak-site claims are early but unverified. In this case, the Qilin claim came about 18 months before any official confirmation. The ONEOK claim by the group Redact, which Class Action U covers and which was posted to both Ransomware.live and Breachsense, shows the same pattern: trackers often report a claim long before, or without, any confirmation from the victim. Defenders and third-party risk teams should watch these feeds, and they should treat the volumes groups claim as unverified.
The Attack Technique
Frazer has not disclosed how the attacker got in, and none of the sources describe an initial access vector. Here is what is known:
- Unauthorized access lasted about two days, March 24 to 25, 2025.
- Network connectivity was disrupted on March 25. That pattern fits encryption or containment actions such as taking systems offline.
- Qilin, a ransomware-as-a-service operation that uses double extortion, claimed the attack and threatened to leak the data.
For general context only, not as a finding about Frazer: Qilin affiliates have historically gotten in through exposed VPN and remote-access appliances without MFA, stolen credentials, and phishing. They usually steal data before deploying encryptors. A two-day dwell time is short and suggests that data theft and encryption happened in quick succession.
What Organizations Should Do
- Require phishing-resistant MFA on all remote access. That means VPN, RDP gateways, Citrix and Microsoft 365. Retire or patch internet-facing appliances that have known exploited vulnerabilities.
- Detect large outbound transfers. Alert on unusual egress volume and on rclone, MEGA or other cloud-sync tools on file servers. If 69GB leaves over two days, it should trigger an alert.
- Know where your PII is before an incident. Keep a current data inventory of client SSNs, tax returns and banking data. Then the post-breach review takes weeks instead of 18 months, and you can meet state notification deadlines.
- Shrink and segment client data stores. Archive or purge records past their retention period, and isolate tax and payroll repositories from general file shares and workstations.
- Keep offline, immutable backups and rehearse ransomware response. Run tabletop exercises with outside counsel and forensics firms that are already on retainer. Include a decision on early notification while the investigation continues.
- Third-party risk teams: check your accountants. Ask CPA and payroll vendors to show evidence of MFA, EDR and data retention controls. Add their names to your leak-site monitoring.
Sources: Frazer LLP Data Breach: 69GB of Client Data Stolen | Frazer LLP data breach notice, Oct 16, 2026 AcidPeak | Frazer LLP Data Breach Lawsuit - Class Action U | zer LLP Data Breach Lawsuit Emery Reddy | Frazer LLP Data Breach Exposes Personal Information | Frazer LLP Data Breach Letter (2026): Your Rights | ONEOK Data Breach Lawsuit | Cybersecurity News EmailMeNow