Data breach reported for Cyrus D. Mehta & Partners

Key facts: Cyrus D Mehta & Partners PLLC data breach

• Date reported: February 23, 2026.
• Unauthorized access identified: May 11, 2025.
• Target entity: Cyrus D Mehta & Partners PLLC (cyrusmehta.com).
• Source of breach: Unknown, unauthorized third-party.
• Data types: Addresses, demographic details, dates of birth, Social Security numbers, and government identification (such as passport numbers).
• Status: Confirmed; the firm discovered suspicious activity in May 2025 and issued official notice letters on February 23, 2026.
• Severity: Medium; involves the potential removal of sensitive personal identification data by an unauthorized party.

Start continuous breach monitoring with UpGuard.

What happened in the Cyrus D Mehta & Partners PLLC data breach?

Cyrus D Mehta & Partners PLLC (cyrusmehta.com) disclosed a data incident on February 23, 2026. The breach involved unauthorized access to the firm's internal systems, which was first discovered on or around May 11, 2025. No specific threat actor has been linked to the attack at this time.

The incident resulted in the potential exposure of sensitive information related to individuals who received immigration services. The compromised data includes addresses, demographic details, dates of birth, Social Security numbers, and various forms of government identification. This medium-severity incident highlights the risks associated with unauthorized system access. While the firm has not found evidence of misuse, such events typically pose risks of identity theft and targeted phishing attacks.

Who is behind the incident?

The attacker or cause of the incident has not been identified.

Impact and risks for Cyrus D Mehta & Partners PLLC customers

For those affected, the exposure of Social Security numbers and government identification presents a risk of identity theft and credential abuse. Individuals may also face increased phishing attempts or fraudulent financial activity. Because demographic information and addresses were also involved, malicious actors could potentially use this data to build sophisticated social engineering profiles.

Such incidents often lead to long-term monitoring requirements for victims; affected individuals should consider freezing credit reports and enabling fraud alerts. Maintaining transparency about the scope of the breach helps users take timely protective actions to mitigate these potential consequences.

How to protect against similar security incidents

Get instant alerts when your data appears on the dark web.

Frequently Asked Questions

What happened in the Cyrus D Mehta & Partners PLLC security breach?

On February 23, 2026, Cyrus D Mehta & Partners PLLC (cyrusmehta.com) disclosed a security breach. According to initial reports, the firm experienced unauthorized access to its systems, potentially exposing personal data belonging to individuals who utilized their immigration services.

When did the Cyrus D Mehta & Partners PLLC breach occur?

The Cyrus D Mehta & Partners PLLC breach was publicly reported on February 23, 2026. The exact date of the attack has not been disclosed, though the firm discovered the unauthorized access on or around May 11, 2025.

What data was exposed?

The types of data involved in the Cyrus D Mehta & Partners PLLC incident include addresses, demographic information, dates of birth, Social Security numbers, and government identification.

Is my personal information at risk?

If you interacted with Cyrus D Mehta & Partners PLLC, there's a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts.

How can I protect myself after this data breach?

• Change passwords and use a password manager.
• Enable multi-factor authentication (MFA) on all sensitive accounts.
• Monitor financial and credit reports for suspicious activity.
• Be cautious of unsolicited communications or phishing attempts.
• Utilize breach monitoring tools to track data exposure.
• Monitor your "MyUSCIS" or immigration portal accounts for any unauthorized changes or suspicious communications.
• Report lost/stolen passports if you believe your specific passport number is being misused,

What steps should companies take after being impacted by this breach?

To address the incident, Cyrus D Mehta & Partners PLLC has worked to secure its systems and enhance existing security measures. Companies in this position typically notify affected parties, provide guidance on protective actions, and deploy attack surface management tools to prevent future unauthorized access.