Frazer LLP Data Breach

Frazer, LLP, a California accounting firm, lists March 25, 2025, as the date of a data breach. The firm did not report the breach to California regulators until October 16, 2026, about 570 days later.

Frazer, LLP is a certified public accounting (CPA) and consulting firm. Its main office is in Anaheim, California, and it has a second office in Visalia. The firm handles audit, tax and advisory work for businesses and individuals, with a focus on agriculture, dairy and real estate.

On October 16, 2026, Frazer filed a breach report with the California Attorney General. The filing lists the date of the breach as March 25, 2025. Frazer also filed a redacted (blacked-out) sample of the notice letter it is sending to affected people.

How the Breach Unfolded

The sample letter refers to “this incident” and to “the date of the potential access,” which means an outside party may have reached files it should not have seen. The readable portion of the sample letter does not describe how the intrusion happened.

Breach tracker Breachsense reports that the ransomware group Qilin claimed an attack on Frazer in late March 2025. Ransomware is malicious software that locks or steals a victim’s files so criminals can demand payment. Breachsense reports that Qilin claimed about 69 GB of data. Frazer has not publicly confirmed the Qilin claim, and that claim is not independently verified.

Why the 19-Month Delay Matters

Frazer’s own filing puts the breach in March 2025. Its report to the California Attorney General came in October 2026. That is a gap of nearly 19 months. Frazer has not publicly explained why notice took this long.

A long delay matters. Stolen data can be sold or misused well before people learn it is gone. People who do not know about a breach cannot freeze their credit or watch for fraud. Accounting firms often hold detailed financial records for their clients. Frazer has not disclosed whose records were involved or whether tax records were part of this incident.

Frazer has not disclosed the total number of people affected. The California filing does not list a count.

What Information Was Exposed?

The sample notice is redacted, and its readable text does not include a full list of exposed data. Based on what the official notice does show:

• Medical information: the letter refers to “your medical information involved in this incident.”
• Other data types (such as Social Security numbers, tax records or financial accounts): not disclosed in the readable portion of the sample notice.

Each person’s letter may list the specific data involved for that person. Letter recipients should check their own letter carefully.

What Is Frazer Offering Affected Individuals?

According to the sample notice, Frazer is offering free credit monitoring through IDX, an identity protection company.

• Enrollment: through IDX online or by scanning the QR code on the letter, using the enrollment code printed at the top.
• Enrollment deadline: January 16, 2027.
• IDX phone: 1-866-200-0933.
• Length of coverage: not shown in the readable sample (check your letter).

The monitoring only works if each person activates it before the deadline.

Your Information Is at Risk

Personal and medical details in criminal hands can lead to identity theft, insurance fraud and targeted scams. Medical identity theft happens when someone uses another person’s health information to get care, drugs or insurance payments. It can leave false entries in a medical record that are hard to fix. Data from an accounting firm can also be used in phishing, which means fake emails or calls designed to trick people into sharing more information.

Affected individuals should:

• Enroll in the IDX monitoring before January 16, 2027.
• Place a free fraud alert or security freeze with Equifax, Experian and TransUnion.
• Review bank statements, credit reports and health insurance statements for unknown activity.
• Treat any call or email that mentions Frazer or this breach with caution.
• Report identity theft to the FTC at IdentityTheft.gov.

Do You Have Legal Options?

Accounting firms that collect personal, financial and medical information have a legal obligation to safeguard it. They must also give timely notice when that information is put at risk. When those duties are not met, affected individuals may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many people were affected by the Frazer LLP data breach?

Frazer has not disclosed a total. Its California Attorney General filing does not include a count.

When did the Frazer breach happen?

Frazer’s filing lists March 25, 2025, as the date of the breach. The firm reported it to California regulators on October 16, 2026.

What information was exposed?

The readable part of the sample notice refers to medical information involved in the incident, which suggests medical data was involved for at least some people. Other data types are not shown. Your own letter should list what was involved for you.

Why did it take so long for Frazer to notify people?

Frazer has not explained the gap of nearly 19 months between the breach and its report to regulators.

Was this a ransomware attack?

The Qilin ransomware group claimed an attack on Frazer, according to Breachsense. Frazer has not publicly confirmed that claim.

What should I do if I received a notification letter?

• Enroll in IDX monitoring before January 16, 2027.
• Freeze your credit with all three bureaus.
• Check your health insurance statements for services you did not get.
• Keep your letter and any related records.
• Contact Emery | Reddy for a Free Case Review.

How can I protect myself from scams that mention this breach?

Criminals often use news of a breach to send fake emails, texts or calls. Do not click links or share information with anyone who contacts you about the breach out of the blue. Use only the phone numbers printed in your letter or on official websites.

Do I have a legal claim?

Organizations that hold your personal and medical information have a duty to protect it and to tell you promptly when it is at risk. If you received a letter from Frazer, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.