The California Office of the Attorney General disclosed that McKinney & Company suffered a data breach on April 1, 2020, compromising the personal information of undetermined clients. The exposed data included highly sensitive details such as full names, Social Security numbers, and bank account information. The breach was formally reported on June 12, 2020, nearly two and a half months after the incident occurred. The delay in disclosure raises concerns about the company’s incident response protocols and the potential misuse of the stolen data during the interim period. The nature of the leaked information—particularly Social Security numbers and financial records—poses severe risks, including identity theft, financial fraud, and long-term reputational damage for affected clients. Given the sensitivity of the compromised data, the breach likely falls under regulatory scrutiny, potentially triggering legal obligations for notification, remediation, and compliance penalties. The incident underscores vulnerabilities in McKinney & Company’s cybersecurity defenses, particularly in safeguarding personally identifiable information (PII) from unauthorized access or exfiltration.