Nebraska accounting firm DA&E says cyber incident impacted over 80,000 customers

U.S.-based accounting firm Dohman, Akerlund & Eddy said that a major data security incident it suffered earlier this year compromised the sensitive personal information of more than 80,000 individuals.

 

In a notice of data security incident filed with the Office of Maine Attorney General, the Aurora, Nebraska-based accounting firm said that on February 28, it experienced disruptions in its internal network and quickly commissioned an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation determined that certain files may have been acquired without authorisation on or about February 28, 2024,” DA&E said. “We then conducted a comprehensive review of the affected data to determine whether personal information may have been involved. 

 

“After a thorough review of the impacted data, on September 26, 2024, it was determined that some of your personal information was present in the impacted data set,” the firm said in its breach notification letter to affected customers.

 

It said the compromised data included names, addresses, dates of birth, Social Security numbers, medical treatment & diagnosis information, dates of service, health insurance provider names, health insurance claim information, and treatment cost.

 

DA&E’s filing with the Maine state regulator revealed that at least 82,207 individuals were impacted by the cyber security incident.

 

“In response to this incident, DA&E implemented additional security measures to further minimise the risk of a similar incident occurring in the future. DA&E also notified law enforcement and is reviewing its policies and procedures related to data protection,” the company added.

 

While DA&E found no evidence of the compromised information being misused, it has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

The firm has also offered one year of complimentary identity protection and credit monitoring services through IDX to all the affected individuals.