Goff Backa Alfera Data Breach Exposed SSNs and Government ID Numbers

Goff Backa Alfera & Co. LLC, a full-service accounting and consulting firm based in Pittsburgh, disclosed a data breach that exposed sensitive personal information.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation. The company began mailing notification letters to affected individuals on Sept. 18, 2026.

On Feb. 17, 2026, a ransomware group known as Lynx posted a claim on the Tor dark web network stating it had obtained data from the firm. The compromised data reportedly included financial documents and accounting records.

The specific dates when the attack occurred and how the firm first discovered the incident have not been detailed in the company's notification to consumers.

The types of personal information confirmed as exposed in the breach included names, Social Security numbers, medical records, financial account information, driver's license numbers and credit or debit card numbers, as disclosed in regulatory filings.

Goff Backa Alfera & Co.'s response to the breach

The firm is offering 24 months of complimentary credit monitoring and identity theft protection services through HaystackID, a company that specializes in fraud assistance and remediation services.

Affected individuals can enroll in credit monitoring services at no charge by visiting Equifax's activation page and entering the unique activation code included in their notification letter. Enrollment must be completed within 90 days of the date of the letter.