Young & Company Data Breach: SSNs Exposed

Young & Company LLC, an accounting and professional services firm based in Lake Mary, Florida, has disclosed a data breach involving unauthorized access to employee email accounts.

The breach began when Young & Co. was alerted to unusual activity involving an employee's email account. The company began an investigation to understand the nature and scope of the suspicious activity.

The investigation determined that an unauthorized person gained access to certain employee email accounts between Feb. 24, 2025, and May 22, 2025.

After discovering the compromised accounts, Young & Co. began reviewing the data contained within them to determine whether personal information was involved. The company worked to identify the specific individuals whose information may have been at risk. Young & Co. also engaged a third-party vendor to conduct an advanced search to confirm address information and ensure that notifications would reach the correct individuals.

According to the company's notification, this data review process was completed on or around March 31, 2026. That was approximately 10 months after the unauthorized access period ended.

The types of personal information exposed in the breach included names and Social Security numbers.

The breach has been reported to the Maine Attorney General and to the Massachusetts Office of Consumer Affairs and Business Regulation. Consumer notification letters are dated May 11, 2026.

Young & Co.'s response to the breach

Young & Co. is offering affected individuals access to 12 months of credit monitoring services through IDX, at no cost. To enroll, individuals can visit the IDX enrollment page. The deadline to enroll in these services is Aug. 11, 2026.

A dedicated call center has been set up for individuals who have questions about the breach or need help with enrollment. The number is 1-833-788-9712, and representatives are available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time, excluding holidays.

Individuals may also write to Young & Co. at 3599 W Lake Mary Blvd., Suite A, Lake Mary, FL 32746, with any questions or concerns.

Steps to take if your information was exposed

• Place a fraud alert or credit freeze on credit files by contacting Equifax (1-888-298-0045), Experian (1-888-397-3742) or TransUnion (1-833-799-5355) to help prevent unauthorized accounts from being opened.
• Request free credit reports at AnnualCreditReport.com and review them carefully for any unfamiliar accounts or suspicious activity.
• Monitor bank accounts and financial statements closely over the next 12 to 24 months and report any unauthorized transactions to the relevant financial institution right away.
• Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov or by calling 1-877-438-4338, and consider filing a report with local law enforcement as well.
• Be cautious of phishing attempts that reference Young & Company or this data breach by name, as scammers sometimes use real breach notifications to trick people into sharing additional personal information.