An Auditor's Breach Took Nearly a Year to Reach Some Bank Customers: Questions to Ask the Firms That Hold Your Files

Late in 2025, someone got into the systems of Mercadien, P.C. CPAs, a New Jersey accounting firm that does audit and advisory work for banks and credit unions. A year later, the notices are still arriving. On Oct. 29, 2026, Bangkok Bank's New York branch filed its letter with California's attorney general. Nine days earlier, a Mercadien letter went on file for a bank engagement that, by Mercadien's own account, ended in 2023.

The bank customers getting these letters never did business with Mercadien. Their bank or credit union sent files to its auditor, and those files were still on the auditor's side when the intruder came through. That pattern isn't limited to banks. Law firms, nonprofits, medical groups and manufacturers all send client and employee files to outside accountants, auditors and consultants.

What's been reported

What Mercadien says happened. In a sample letter filed with California (posted Oct. 20), Mercadien says it detected the incident on Nov. 7, 2025, and that it involved "unauthorized access to Mercadien's environment resulting from the exploitation of a security vulnerability sometime between September 17, 2025, and October 8, 2025." It doesn't say which vulnerability.
Where the files were. Orange Bank & Trust's substitute notice says the incident "involved Box.com data," a platform Mercadien used to support its services, and that "unauthorized actors obtained OB&T vendor files transferred via Box.com." The notice doesn't say Box itself was hacked; it describes Mercadien's files on it.
What was in them. It varies by client. Mercadien's letter lists name and Social Security number, and in some limited cases driver's license, date of birth and bank account number. Orange Bank's notice also lists passport, government ID and taxpayer ID numbers. Bangkok Bank's letter lists name, address, date of birth and Social Security number.
The long wait. Mercadien says it gave one bank initial notice on Dec. 17, 2025, but didn't deliver its findings until Aug. 14, 2026. Bangkok Bank says it was told on Aug. 12, 2026. Fairwinds Credit Union in Orlando, which hired Mercadien for an independent assessment required of credit unions, says it learned on Aug. 13, 2026, and has ended the relationship.
How wide. American Banker reported on Oct. 8 that the breach reached at least nine banks and credit unions. No final total has been published by Mercadien.
What hasn't been reported. None of the notices we read reports misuse of the data, and none mentions ransomware, encryption or a ransom demand. Orange Bank, Fairwinds and Mercadien's own letter all say the banks' and credit unions' own systems weren't affected.

Why a small business should care

Your outside accountant, auditor, payroll consultant or law firm needs real data to do the job, so you send it. What happens to it afterward is usually nobody's job. If the files sit in a shared folder long after the engagement ends, a breach at that firm becomes your breach notice, on your letterhead, on their timeline. Mercadien's own letter shows data from a job that wrapped up in 2023 was still in its environment in late 2025.

The fix isn't technical wizardry. It's three questions at the start of every engagement and one at the end.

Clear takeaway

If you send customer, client or employee files to an outside accountant, auditor or consultant, know where those files sit, put a breach-notice deadline in the engagement letter, and get them deleted, in writing, when the job ends.

What to do this week

List who has your files. Outside CPA and tax firm, auditors and examiners' prep consultants, payroll and benefits advisers, outside counsel. Note what each received in the last five years.
Ask where the files live today. Which platform, whose account, and whether shared links expire. "In a folder on our file-share" is an answer you need to follow up on.
Ask for deletion of finished jobs. Firms have to keep their workpapers, but they don't need a live copy of your customer list on a transfer site. Ask them to remove old engagement files from shared platforms and confirm in writing.
Put a notice deadline in the contract. Require the firm to tell you within a fixed number of days that your files were in an affected environment, before its full review is done. Mercadien gave one client initial notice in December but findings in August.
Send less. Redact Social Security numbers and account numbers unless the work truly needs them, and use a sample instead of a full export when you can.
Share from your side. Where possible, give outside firms access through your own Microsoft 365 or file-share with expiring links you control, so you can see and revoke access.
Be ready to notify. Know who drafts your customer letter, who handles the calls, and whether your cyber insurance covers a vendor's breach. And warn customers that you'll never ask for passwords or codes by phone or text.

How Brotherly Technology can help

Brotherly Technology can map which outside firms hold your client and customer files, set up secure sharing from your own Microsoft 365 with expiring links, and help you write the vendor questions and contract language your accountant and auditors should answer. If you're not sure where last year's audit files ended up, call us and we'll help you find out.