Forrestall CPAs LLC Data Breach Notice (California Attorney General)

If you received a breach notification from Forrestall CPAs LLC, your personal information was included in an incident the firm reported to the California Attorney General. The filing lists personal information as exposed but does not state how many people were affected. No passwords were exposed.

That single fact changes the picture. Because no credentials were part of the exposed data, this is not an account takeover incident. Your Forrestall account itself is not at immediate risk from this breach. What is at risk is the lifelong identity information that accountants routinely hold: names, addresses, Social Security numbers, and tax-related records. These details do not expire. They cannot be reissued like a credit card or password. Once they leave the company’s control, they remain valuable to identity thieves for years or decades.

What the Exposed Personal Information Actually Enables

When a tax preparer’s records are exposed, the combination of your name, address, SSN, and tax data becomes a high-quality identity kit. Fraudsters can use it to file fraudulent tax returns before you do, claim refunds in your name, open credit accounts, apply for government benefits, or create synthetic identities. Because tax data often includes prior-year income details, it can help attackers bypass knowledge-based authentication questions that many banks and agencies still rely on.

The absence of passwords in the exposed dataset is genuinely good news. You do not need to change your password with Forrestall CPAs because of this incident. That particular worry can be set aside. The permanent identifiers that matter most cannot be changed, which is why this exposure carries long-term consequences rather than short-term ones.