Frazer LLP, a $20.2 million Anaheim CPA firm, had a cybersecurity incident on March 25, 2025. Its breach notice reached the California Attorney General's list on October 16, 2026 -- 570 days later. Four other firms holding client Social Security numbers did the same thing this fall. The hack wasn't the expensive decision. The silence was.
Frazer has been doing the books for California farms, dairies, builders and real estate owners since 1918. It ranks No. 260 on INSIDE Public Accounting's 2026 IPA 500, with $20,237,087 in net revenue, working out of Anaheim and Visalia. In other words, it is exactly the kind of firm that holds the payroll files, bank details and Social Security numbers of a lot of business owners and their employees.
Its own notice, filed with the California Attorney General, lays out the timeline. "On or about March 25, 2025, Frazer experienced a cybersecurity incident that impacted connectivity to our network." Then: "After an extensive forensic investigation and comprehensive document review, on September 18, 2026, we determined your personal data may have been subject to unauthorized acquisition." That determination came 542 days after the incident. The letter does not say how many people are affected.
Here's the part that should bother every owner reading this. Frazer is not an outlier. In one five-week stretch this fall, state breach filings picked up:
Put the letters side by side and something jumps out. Frazer's opens: "The privacy and security of the personal information we maintain is of the utmost importance to the Frazer, LLP." The Tulare County agency's letter opens with the same sentence, word for word, swapping in its own name.
Both say the firm "immediately" began "a prompt and thorough investigation." Both say the firm is "committed to maintaining the privacy of personal information" in its possession and has "taken many precautions to safeguard it." Both send you to a hotline open 9 a.m. to 9 p.m. Eastern Time -- for clients in Anaheim, Visalia and the San Joaquin Valley.
That's not a coincidence of style. It's a template. And it was built for one reader: a regulator.
You can see it in the arithmetic. Frazer's notice hit the AG's list 28 days after its "determination." The Tulare County agency mailed 28 days after its determination. California Civil Code 1798.82, as amended by SB 446 effective January 1, 2026, says notice is due "within 30 calendar days of discovery or notification of the data breach," and allows a delay "as necessary to determine the scope of the breach." Both firms landed two days inside a 30-day window. The window just started when the forensic review ended, not when the network went down.
To be clear, I'm not saying anybody broke the law. Both incidents predate the 2026 amendment, and the scope exception exists for real reasons. I'm saying the letter was written to survive a regulator, and nobody wrote anything at all for the client in between.
Tarter Krinsky at least explained itself, telling California that "the data review was necessarily lengthy due to the volume and complexity of the in-scope documents." In the same filing, it reserved the right to argue that California's notice law doesn't apply to it. That's a law firm being a law firm. It isn't a client relationship.
And "impacted connectivity to our network" tells a Visalia dairy owner nothing about whether to call his bank.
No lawsuit against Frazer had surfaced as of October 21. The plaintiffs' bar is already circling -- at least two plaintiff firms posted Frazer "investigations" by October 20, four days after the AG listing. Here's what the next step looked like for the firm that did this in July.
Fiesta Insurance Franchise Corporation, a Las Vegas insurance and tax-prep franchisor with more than 220 storefronts (ClassAction.org, July 14, 2026), learned of its incident June 9, 2025, and started mailing notices July 13, 2026. That's 399 days. The first class action was filed in federal court in Nevada on July 16. Three days. By August 12, five suits had been consolidated into one. The first complaint does the 399-day math itself and cites California's 30-day statute. Those are allegations, and Fiesta hasn't been found liable for anything. But by waiting, it wrote the plaintiffs' best paragraph for them.
Here's the end of that road. Absolute Dental Group, the Nevada dental group with more than 50 locations (HIPAA Journal, Sept. 2, 2025), mailed patient letters in August 2025, about six months after its intrusion ended. Patients sued that year. On October 28, 2026, the administrator starts paying claims out of a $3.3 million settlement fund. Absolute denies any wrongdoing.
Now Frazer's own exposure. This is my estimate, not a reported figure. CPA clients are sticky, and that cuts both ways. They won't leave over a fee increase. They absolutely will leave over learning, 19 months late, that their employees' Social Security numbers may have walked out the door. On $20.2 million in net revenue, every 1% of clients who quietly move their returns elsewhere costs about $202,000 a year. Lose 3% and it's about $607,000 a year, for every year those relationships would have run. That's before breach counsel, forensics, mailing, a call center, IDX monitoring and whatever a class action settles for.
The cost that never shows up on Frazer's books is the one its clients carried: 542 days of not knowing they should freeze their credit, or call to confirm the next wire instruction that landed in their inbox.
The first four hours of a breach at a 95-person firm aren't about the regulator. Here's what I'd have done on March 25, 2025.
Hour one: call the cyber insurer and breach counsel, and get forensics in the building. Frazer did this. Its letter says so. Good.
Hours two through four: write the client note, and send it before close of business. Not the statutory letter -- that comes later. A plain two-paragraph email from the managing partner to every client. We had a network intrusion today. We don't yet know what, if anything, was taken. Until we do, here are three things to do now: put a free freeze on your credit, confirm any change to wire or payment instructions by phone, and ignore any email that looks like it's from us asking for money. We'll update you by this date, whether or not we know more.
That note admits nothing a lawyer should lose sleep over. It says what's known, what isn't and what to do. Then keep the promise: an update every 30 days until the review is done, and notice in waves as files are identified, instead of waiting a year and a half for a perfect list.
Then separate the two clocks, out loud, inside the firm. The statute tells you the latest date your formal letter can go out. It doesn't tell you when to pick up the phone. Your lawyer runs the first clock. You run the second one, because nobody else is going to.
Call it the Two Clocks rule. The legal clock starts when the review ends. The client clock started the day the network went down, and it's been running the whole time, whether you're talking or not.
I'm Hani Durzy. I spent 25 years running communications at LinkedIn, eBay, and Realtor.com. Red Dog Strategies helps owner-led businesses control what customers, and the AI tools they now ask first, hear about them. Want to know what the machines say about your business when you're not in the room? Click here to get your free Red Dog AI Visibility Score.
