On May 11, 2020, Ives Sultan & Spike CPAs (ISS) suffered a data breach due to unauthorized access to an employee’s email account. The incident, reported to the Maine Office of the Attorney General on September 16, 2021, exposed sensitive personal information of 5,792 individuals, including driver’s license numbers and Social Security numbers. The breach stemmed from a compromised email account, likely through phishing or credential theft, allowing attackers to access confidential data. While the exact duration of unauthorized access remains undisclosed, the exposure of such highly sensitive information poses significant risks, including identity theft, financial fraud, and long-term reputational damage for the affected individuals. The firm’s delayed public disclosure—over a year after the breach—further exacerbates concerns about transparency and incident response protocols. The compromised data primarily belonged to clients or employees, highlighting vulnerabilities in the company’s email security and data protection measures.