Data Breach & Privacy
Blog > Data Breach & Privacy
Aldrich Services Data Breach: Unknown Individual Accessed Staff Email
Aldrich Services LLP, which shares an Oregon address with Aldrich CPAs + Advisors, says an unknown individual accessed an employee email account on August 22 and 23, 2026. Massachusetts records list Social Security numbers and financial account information. Here’s what the letters say and what to do.
What Happened at Aldrich Services
An employee email account accessed August 22 to 23, 2026
In notice letters dated October 1, 2026, Aldrich Services LLP says it became aware of suspicious activity involving one of its employees’ email accounts. The company says it secured the account, confirmed the security of its email environment and began a comprehensive investigation.
The investigation found that an unknown individual accessed the account from August 22 to August 23, 2026. Aldrich then reviewed the potentially affected data for sensitive information and says it completed a preliminary review on or around September 28, 2026. The letters do not explain how the account was compromised.
Who May Have Received an Aldrich Letter
A firm with offices across five western states
Aldrich Services LLP lists the same Lake Oswego, Oregon, address as the Portland-area office of Aldrich CPAs + Advisors, a firm whose website describes accounting, tax, audit, employee benefit and retirement plan services. That firm lists offices in Oregon, Washington, California, Colorado and Utah, including Carlsbad, Brea and San Diego in California.
The letters do not say whether the people notified are clients, employees or others. Aldrich filed a sample notice with the California Attorney General on October 1, 2026, and California requires that filing when a breach notice goes to more than 500 state residents, which suggests Californians may be among those notified. Massachusetts lists eight residents of that state, the letter mentions about one Rhode Island resident, and no nationwide total has been released.
How Aldrich Services Responded
Experian monitoring offer and a Jan. 29, 2027 deadline
Aldrich says it notified law enforcement and relevant regulators and is reviewing and enhancing its policies and procedures to limit the chance of a repeat. The letters offer complimentary Experian IdentityWorks credit and identity monitoring; the version filed in Massachusetts specifies 24 months, while the California sample leaves the length blank, so check your own letter.
Enrollment closes January 29, 2027, and requires the activation code printed in each letter. According to the letters, IdentityWorks includes credit monitoring at Experian, identity restoration support and identity theft insurance, and no credit card is needed to sign up. Aldrich also states that the notice was not delayed by law enforcement.
Protecting Your Accounts After the Aldrich Breach
Tax, credit and account protections to consider
With Social Security numbers and financial account information in the Massachusetts filing, these steps focus on tax and financial fraud:
- Enroll in IdentityWorks before January 29, 2027. The activation code in your letter stops working after that date.
- Get an IRS Identity Protection PIN. Aldrich’s own letter recommends this six-digit number, which the IRS uses to keep others from filing returns under your Social Security number.
- Watch bank and investment accounts closely. Unfamiliar withdrawals, transfers or changes to your contact details are worth flagging with the institution promptly.
- Lock down new credit with a free freeze. A freeze at each of the three nationwide bureaus keeps lenders from opening accounts in your name without your say-so.
- Be skeptical of calls and emails about your taxes or accounts. Scammers often pose as accountants, the IRS or a bank, so confirm any request using contact information you already have.
This is a general checklist rather than legal advice; a legal professional can tell you which steps fit your situation.
Talk to Wilshire Law Firm
Worried about what the Aldrich letter means for you?
Did a letter from Aldrich Services say your Social Security number or financial account information may have been involved? Wilshire Law Firm is a nationally recognized, award-winning Los Angeles firm that reviews data privacy claims, and breaches at financial and accounting firms are sometimes pursued as class actions. Ask a legal professional about your letter in a free consultation or free case review; we’re available 24/7, and there are no fees unless you get paid.
Reach out to Wilshire Law Firm to talk through your next steps.
FAQs
Aldrich says an unknown individual accessed an employee email account from August 22 to August 23, 2026. Its preliminary review of the affected data finished on or around September 28, and its notice letters are dated October 1, 2026.
Each letter lists the recipient’s name plus the data elements that apply to them. Massachusetts’ 2026 breach report shows Social Security numbers and financial account information for the Massachusetts residents notified.
Aldrich has not published a total. Massachusetts lists eight residents of that state, the letter mentions about one Rhode Island resident, and the company filed a sample notice with California’s Attorney General.
Yes. The letters offer Experian IdentityWorks at no cost, and the Massachusetts version specifies 24 months. Enrollment closes January 29, 2027.
Aldrich Services LLP lists the same Lake Oswego, Oregon, address as the Portland-area office of Aldrich CPAs + Advisors. The notice letters are issued in the name of Aldrich Services LLP and don’t describe the relationship further.
Aldrich says it has received no reports of identity theft or fraud as a result of the event. That reflects what the company knew when the letters went out, so keeping an eye on your credit, bank and tax accounts is still worthwhile.
You may have options. Aldrich’s notice says an unknown individual accessed an employee email account, and Massachusetts records list Social Security numbers and financial account information among the data involved. Situations like this one are often reviewed as possible class action claims, and a free case review can help you understand yours.
Start Your Free Case Review
- Available 24/7
- Hablamos Español
- Nationally-Recognized Powerhouse Team
As seen in:
We'll contact you within minutes
No fees unless you get paid.
Information Listed for Aldrich Recipients
Social Security numbers and financial account details
Each letter is filled in with the recipient’s name and the data elements that apply to that person, so the samples on file with regulators leave that list blank. Massachusetts’ 2026 breach report, however, records the data types for the eight Massachusetts residents notified: Social Security numbers and financial account information.
Aldrich has not described the contents of the mailbox beyond those categories. It says it has received no reports of identity theft or fraud as a result of the event.