DeMera DeMera Cameron Data Breach

A Fresno accounting firm says files were downloaded from its network in March 2026. Clients did not get letters until September, and the deadline to enroll in free monitoring is December 1, 2026.

DeMera DeMera Cameron, LLP (“DDC”) is a certified public accounting firm in Fresno, California that provides tax, audit and advisory services.

According to its notice letter, DDC became aware of suspicious activity in its network on or about March 27, 2026. It launched an investigation with independent forensic experts and learned that certain files may have been downloaded without authorization.

DDC says a full review of those files ended on July 23, 2026. Notice letters are dated September 1, 2026.

More Than Five Months From Discovery to Notice

The timeline from DDC’s own letter:

• March 27, 2026: DDC becomes aware of suspicious activity
• July 23, 2026: file review ends, about four months later
• September 1, 2026: letters dated, 40 days after the review ended

In total, about five months passed before affected people were told. DDC has not explained the length of the review or the 40 days that followed it.

Why an Accounting Firm Breach Is a Serious Risk

Accounting firms hold the information people use to file taxes: Social Security numbers, ID numbers and bank details. That is exactly what criminals need to file a fake tax return and claim someone else’s refund.

DDC reported to the Indiana Attorney General that 2,387 people were affected in total. DDC also filed with the California and Vermont Attorneys General.

What Information Was Exposed in the DeMera DeMera Cameron Breach?

DDC’s sample letter leaves the data types as a blank field. According to the Vermont Attorney General’s breach notice table, the information involved includes:

• Social Security number
• Government-issued ID number
• Financial account information
• Credit and debit account information

Each person’s letter lists their own information along with their name. DDC says it has no current evidence of misuse.

What Is DeMera DeMera Cameron Offering? Enroll by December 1

DDC is offering free credit monitoring and identity protection through IDX. According to the letter, the services include credit and dark web monitoring, an insurance reimbursement policy and identity theft recovery help. The length of service (12 or 24 months) depends on the person’s letter.

• Enrollment deadline: December 1, 2026
• IDX phone: 1-833-788-9712, Monday through Friday, 6 a.m. to 6 p.m. Pacific Time
• Enrollment code: printed on each person’s letter

Affected individuals can also take these steps:

• Request an Identity Protection PIN from the IRS before tax season
• Place a free credit freeze with all three credit bureaus
• Watch bank and card statements for charges you do not recognize
• Call your bank about any account listed in your letter

What Legal Options Do Affected Clients Have?

Accounting firms that collect clients’ Social Security numbers and financial information have a legal duty to protect it and to notify people promptly when it is exposed. When that duty is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the DeMera DeMera Cameron data breach?

DDC reported 2,387 people affected in total to the Indiana Attorney General.

What information was exposed?

According to the Vermont filing, the information includes:

• Social Security number
• Government-issued ID number
• Financial account information
• Credit and debit account information

Why did it take five months to notify people?

DDC found the activity March 27, 2026, finished reviewing files July 23 and sent letters September 1. It has not explained the delay.

Is there a deadline to enroll in the free monitoring?

Yes. The IDX enrollment deadline is December 1, 2026. Call 1-833-788-9712 or use the code in your letter.

How do I protect my tax refund?

Request an Identity Protection PIN from the IRS. It is a six-digit number that helps stop anyone else from filing a return with your Social Security number.

Could scammers use this breach to contact me?

Yes, that is a common follow-up risk. Scammers sometimes send emails, texts or calls that mention a real breach by name to seem trustworthy. Do not click links or share codes or passwords with anyone who contacts you about the breach. Use the phone number printed on your official letter instead.

Do I have a legal claim?

Possibly. Accounting firms that collect Social Security numbers and financial information have a duty to protect it and to tell people promptly when it is exposed. If that duty was not met, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.