Chicago accounting firm faces class-action lawsuits over 2024 data breach

Chicago, Illinois-based public accounting firm Legacy Professionals is facing several class action lawsuits after it failed to protect the sensitive personal information of more than 216,000 individuals during a cyber security incident.

In a filing with the Office of Maine Attorney General, Legacy Professionals recently said that in April 2024, it experienced  major cyber security incident that resulted in the loss of customer data records. “After receiving additional information in November 2024, the investigation determined that certain files had been taken from Legacy servers by an unauthorised actor,” it said.

The investigation, which concluded February 2025, revealed that sensitive personal information of its clients, including their names, social security numbers and other personal identifiers were compromised during the incident. In a filing with the U.S. Department of Health and Human Service Office for Civil Rights, Legacy Professionals said it identified at least 216,752 individuals who were impacted by the incident.

Recently, Information Security Media Group reported that at least five proposed federal class action lawsuits were filed against Legacy Professionals in the past ten days. According to the lawsuits, Legacy Professionals failed to protect plaintiffs’ and class members’ sensitive private information from cyber criminals. Furthermore, the accounting firm took more than 10 months to notify affected individuals that “caused additional harm.”

“The breach occurred in April 2024 but Legacy did not notify the victims until Feb. 27, 2025. Defendant offered no explanation or purpose for the delay. This delay violates HIPAA and other notification requirements and increased the injuries to plaintiff and class,” reads the proposed class action lawsuit filed by plaintiff Matthew Abraham on behalf of himself and others similarly situated.

The accounting firm in its breach notice added that immediately after identifying the unauthorised access, it terminated the same and secured the affected systems. It also advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general. 

Legacy Professionals has offered two years of complimentary identity protection and credit monitoring services through IDX to all affected individuals.