U.S. accounting firm BerryDunn says third party breach impacted over 1.1 million customers

Berry, Dunn, McNeil & Parker, a Maine-headquartered accounting and consulting service provider, said it suffered a significant data breach that compromised the sensitive personal information of more than 1.1 million individuals.

 

In a notice of data security incident filed with the Office of the Maine Attorney General, Berry, Dunn, McNeil & Parker, LLC (BerryDunn) said that on September 14, one of its vendors, Reliable Networks of Maine, identified suspicious activity in its internal network that affected the internal systems of the company and HAPG. Reliable is a service provider for BerryDunn’s Health Analytics Practice Group (HAPG).

 

BerryDunn immediately launched an investigation, with assistance from third party cyber security experts, to determine the nature and scope of the incident.

 

“The investigation found that an unauthorised actor gained access to Reliable’s network and took some data stored on the HAPG systems,” the company said.

 

The compromised data included names, addresses, dates of birth, Social Security numbers, health insurance policy numbers, Medicare or Medicaid numbers, state or governmental ID numbers, passport numbers, and medical information.

 

The filing with the Maine state regulator also states that at least 1,107,354 individuals were impacted by the data security incident.

 

“BerryDunn has taken steps to secure the HAPG data, such as decommissioning all BerryDunn systems under Reliable’s control and migrating all HAPG data to secure internal BerryDunn systems that are continually monitored as part of our cybersecurity program,” the company added.

 

While BerryDunn found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.