Zelenkofske Axelrod Data Breach Exposed PHI and PII Data

Zelenkofske Axelrod LLC, a regional CPA firm based in Harrisburg, Pennsylvania, disclosed a data breach involving sensitive personal, financial and health-related information.

Zelenkofske Axelrod discovered the breach on Jan. 25, 2026. The firm posted a notice on its website providing details about the incident and resources available to affected individuals.

Between Jan. 23 and Jan. 25, 2026, an unauthorized actor gained access to the firm's systems and copied certain files during that time.

The firm detected suspicious activity within its network and launched an investigation with the help of third-party cybersecurity specialists. The investigation confirmed that files had been accessed and copied during the two-day period of unauthorized access.

On Feb. 23, 2026, a ransomware group known as DragonForce claimed responsibility for the attack on the dark web. The group claimed it had obtained 239.15 GB of the firm's data and threatened to publish the stolen information within six to seven days.

The types of personally identifiable information and protected health information exposed varied by individual but could include names, Social Security numbers, government-issued identification numbers, financial account information and payment card information, medical information and health insurance information.

Zelenkofske Axelrod's response to the breach

The firm encouraged affected individuals to remain vigilant by reviewing account statements, credit reports and explanations of benefits for any suspicious activity.

Zelenkofske Axelrod set up a dedicated call center for individuals with questions about the breach. The phone number is 1-877-201-4537, available Monday through Friday from 9 a.m. to 9 p.m. Eastern time, excluding U.S. holidays.

Individuals may also write to the firm at 830 Sir Thomas Ct., Suite 100, Harrisburg, PA 17109.