DeMera DeMera Cameron, LLP Data Breach

DeMera DeMera Cameron, a Fresno accounting firm, discovered suspicious activity on its network in late March 2026. Clients didn’t start receiving notice letters until September 1, 2026 — more than five months later.

DeMera DeMera Cameron, LLP (“DDC”), a certified public accounting firm headquartered at 5080 N. Fruit Ave. in Fresno, California, has notified clients of a data security incident. According to DDC’s own notice letter, the firm became aware of suspicious activity in its network on or about March 27, 2026. Following an investigation with independent forensic experts that concluded July 23, 2026, DDC determined that certain files, which may have included clients’ personal information, were downloaded from its network without authorization. Notice letters are dated September 1, 2026.

Source: DeMera DeMera Cameron, LLP’s own Notice of Data Breach letter, filed with the California Attorney General (reported 09/01/2026, breach date 03/27/2026).

A Ransomware Group’s Claim, Unconfirmed by DDC

Roughly two weeks after the intrusion, a ransomware group calling itself Akira publicly claimed responsibility for an attack on DDC and threatened to release approximately 260 gigabytes of data unless its demands were met. DDC’s own notice letter does not confirm Akira’s involvement or the specific volume of data taken; the letter states only that certain files may have been downloaded without authorization.

What Information Was Exposed?

DDC’s notice letter states that the information involved may have included each client’s name, along with additional data elements the sample copy of the letter leaves blank. As an accounting firm, DDC’s client files commonly include Social Security numbers, tax return information, and financial account details; DDC has not publicly confirmed which specific categories applied to this incident.

How Many People Are Affected?

DDC has not disclosed a total number of affected individuals.

What Is DDC Offering Affected Clients?

DDC is offering complimentary credit monitoring and identity protection services through IDX, including either 12 or 24 months of credit and dark web monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services. Affected individuals can enroll at app.idx.us/account-creation/protect or by calling 1-833-788-9712. The letter also offers identity protection enrollment for the minor children of affected clients. The enrollment deadline is December 1, 2026.

Your Information Is at Risk

Accounting firms hold some of the most sensitive financial information a person has — Social Security numbers, tax returns, and bank account details among them. If that kind of information was part of this incident, affected clients face a heightened risk of tax fraud, new-account fraud, and other forms of identity theft. Affected individuals should watch for unexpected tax filings under their name and monitor financial accounts and credit reports closely.

Do You Have Legal Options?

Businesses that collect and store clients’ sensitive financial and tax information have a legal duty to secure that data and to notify affected individuals without unreasonable delay.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review if you received a notice letter from DeMera DeMera Cameron, LLP.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

Who is affected by the DeMera DeMera Cameron data breach?

Current and former clients of the Fresno accounting firm DeMera DeMera Cameron, LLP, and their family members whose information the firm held. DDC has not disclosed a total number of affected individuals.

What information was exposed?

DDC’s letter confirms your name was involved and references additional data elements specific to your notice. As an accounting firm, DDC’s client files commonly include Social Security numbers, tax information, and financial account details; check your own letter for the specific categories that applied to you.

Why did it take so long to notify clients?

DDC says it discovered suspicious network activity around March 27, 2026, but its forensic investigation didn’t conclude until July 23, 2026, and notice letters weren’t dated until September 1, 2026 — more than five months after the incident was discovered. DDC has not publicly explained the reason for that timeline.

Was this a ransomware attack?

A group calling itself Akira publicly claimed responsibility and threatened to leak data roughly two weeks after the intrusion. DDC’s own notice letter does not confirm this claim.

Is DDC offering credit monitoring?

Yes. DDC is offering complimentary credit monitoring and identity protection through IDX, including a $1,000,000 insurance reimbursement policy, with enrollment required by December 1, 2026.

Do I have a legal claim?

Businesses that collect and store clients’ sensitive financial and tax information have a legal duty to secure that data and to notify affected individuals without unreasonable delay. If you received a notice letter from DeMera DeMera Cameron, contact the Data Breach Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.