On April 2, 2021, the Maine Office of the Attorney General reported a data breach involving PKF O'Connor Davies linked to a ransomware attack at Netgain Technology, LLC. The breach occurred between November 8 and November 23, 2020, affecting 995 individuals. Compromised data included names, addresses, Social Security Numbers, and financial account information. Identity theft protection services were offered for a period of 12-24 months.

On August 17, 2019, PKF LLP suffered a data breach due to the theft of an unencrypted laptop. The device contained sensitive personal information, including the names and Social Security numbers of affected individuals. The breach was not immediately detected and was only reported to the California Office of the Attorney General on October 17, 2019—two months after the incident occurred. The exposed data poses a significant risk of identity theft, financial fraud, and other malicious activities targeting the victims. The delay in reporting may have further exacerbated potential harm, as affected individuals were left uninformed and vulnerable for an extended period. The incident highlights critical lapses in data security protocols, particularly the failure to encrypt portable devices storing highly sensitive information.