--- title: "Cornick Garber Sandler network-data incident" description: "Cornick Garber Sandler disclosed possible access to personal data during a February–March 2025 network intrusion." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-12" canonical_url: "https://www.ally.security/incidents/cornick-garber-sandler-network-data-incident-2025" markdown_url: "https://www.ally.security/incidents/cornick-garber-sandler-network-data-incident-2025.md" stix_url: "https://www.ally.security/incidents/cornick-garber-sandler-network-data-incident-2025/stix.json" --- # Cornick Garber Sandler network-data incident Cornick Garber Sandler disclosed possible access to personal data during a February–March 2025 network intrusion. Last modified Nov 12, 2026 · 3 sources ## Summary - **Environment:** Accounting firm network files - **Operational impact:** Potential access to personal-information files; outage not quantified - **Financial impact:** No confirmed incident cost quantified ## What happened [Cornick Garber Sandler](https://cgscpa.com/) found that files may have been accessed or removed between February 14 and March 26, 2025. Its review identified personal-data impact on March 12, 2026. [3](#source-3) ## Impact Potential fields varied by person: names with birth dates, Social Security numbers, government or taxpayer IDs, health-insurance information or account numbers. [3](#source-3) Indiana’s [November register](https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-Novemver-2026.pdf), row 317, reports **5,864 affected individuals**, including six Indiana residents. Its separate Voxx entry is not added to that count. [1](#source-1) ## Timeline ### March 12, 2026 — Data review completed Personal information was identified among potentially accessed files. [3](#source-3) ### March 31, 2026 — Public notice issued The [security notice](https://cgscpa.com/securitynotice/) announced notifications beginning that day; Indiana separately lists April 2 as notification sent. [1](#source-1) [3](#source-3) ### July 1, 2026 — Later sample letter issued A [later letter](https://oag.ca.gov/system/files/Cornick%20Garber%20&%20Sandler%20\(Redacted%20Letter\).pdf) described the same 2025 intrusion. [2](#source-2) ### November 12, 2026 — Briefing updated This briefing was last reviewed and updated on November 12, 2026. ## Threat Group & Attack Vector The reviewed notices do not establish the initial entry method or confirm removal of every potentially affected file. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific ATT\&CK technique is mapped from the available evidence. ## Response The firm notified law enforcement and investigated with outside specialists. The July letter offered 12 months of identity monitoring. [2](#source-2) The March notice reported no known related misuse. [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Indiana 2026 security-breach register, November edition regulatory · Indiana Attorney General ### Cornick Garber Sandler July notification sample official · Cornick, Garber & Sandler, LLP · Jul 1, 2026 ### Cornick Garber Sandler notice of data security incident official · Cornick, Garber & Sandler, LLP · Mar 31, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** Later notification sample issued: 2026-07-01 2. **Began At · 100% confidence · current** Cornick Garber Sandler network-data incident: 2025-02-14 3. **Ended At · 100% confidence · current** Cornick Garber Sandler network-data incident: 2025-03-26 4. **Occurred At · 100% confidence · current** Personal-data review completed: 2026-03-12 5. **Occurred At · 100% confidence · current** Public notice announces notification: 2026-03-31 6. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: Personal-data review completed 7. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: Public notice announces notification 8. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: Potential fields varied by person: full name with birth date, Social Security number, driver’s license/state ID, taxpayer ID, health insurance information or account number. No related misuse was known at the March 31 notice. 9. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: Cornick Garber Sandler found that files may have been accessed or removed during February 14–March 26, 2025. Its review identified potentially affected personal information March 12, 2026. 10. **Disclosed At · 100% confidence · current** Cornick Garber Sandler network-data incident: 2026-03-31 11. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: Later notification sample issued 12. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: The March 31 notice announced notifications beginning that day. A later July 1 sample letter described the same access interval and review completion, law-enforcement notification, outside investigation and 12 months of identity monitoring. 13. **Resulted In · 100% confidence · current** Cornick Garber Sandler network-data incident: Indiana’s November report row 317 lists 5,864 total affected individuals, including six Indiana residents, and April 2, 2026 notification. Its separate Voxx-on-behalf entry is not added to that figure. 14. **Affected Organization · 100% confidence · current** Cornick Garber Sandler network-data incident: Cornick, Garber & Sandler, LLP