Wellborn & Company reports data breach following ransomware attack on third-party IT provider

Wellborn & Company, a certified public accounting firm based in Albuquerque, disclosed a data breach after learning that its third-party IT provider suffered a ransomware attack on Aug. 11, 2025. The incident, which did not involve a direct breach of Wellborn & Company’s own systems, allowed cybercriminals to access and download certain data stored on the vendor’s network.

According to a notice filed with the Vermont Attorney General’s office on Oct. 13, 2025, the compromised data included personal information belonging to the firm’s clients. A forensic investigation conducted with external cybersecurity experts determined that the breach exposed names and other types of personally identifiable information, with some records potentially containing financial or tax-related details.

Wellborn & Company began notifying affected individuals after confirming the scope of the incident. The company stated that the attackers were able to exfiltrate data before containment efforts succeeded, increasing the potential risk of identity theft and fraud. In response, the firm implemented additional security measures, including transitioning to a new IT vendor and notifying the Internal Revenue Service and relevant state regulators.

To assist those impacted, Wellborn & Company is providing complimentary identity monitoring services through IDX, which include credit monitoring and identity theft protection. Affected individuals received unique enrollment codes in their notification letters and have until Jan. 10, 2026, to sign up for the services. The company also urged clients to remain vigilant by reviewing financial statements and credit reports for unusual activity and offered guidance on obtaining an IRS Identity Protection PIN to help prevent fraudulent tax filings.

Shamis & Gentile P.A., a national class action law firm specializing in data breach litigation, has announced an investigation into the Wellborn & Company incident. The firm is examining whether affected individuals may be eligible for compensation related to the exposure of their personal information.