Almeida Law Group is investigating a data breach at Rhodes, Young, Black, and Duncan. The breach occurred on September 17th, 2025 – October 12th, 2025 and was discovered on May 27th, 2026. If you were affected, contact Almeida Law Group.
About Rhodes, Young, Black, and Duncan
Rhodes, Young, Black, and Duncan (RYBD) is a CPA consulting firm founded in 1957 and headquartered in Duluth, Georgia. The firm provides tax preparation, accounting, auditing, financial consulting, business advisory, estate planning, and bookkeeping services to individual and business clients across the Greater Atlanta area, serving clients in industries including healthcare, legal, manufacturing, and real estate. Because CPA firms routinely handle tax returns, financial records, and government-issued identification for their clients, they maintain the types of sensitive personal and financial data that were involved in this breach.
What Happened?
Rhodes, Young, Black, and Duncan was listed in a Texas Attorney General data security breach report (record ID BR-0005279). The filing identifies an unauthorized access incident affecting a total of 3,650 individuals. The breach period ran from September 17th, 2025 through October 12th, 2025, with the breach discovery date reported as May 27th, 2026. Consumers were notified by U.S. Mail. The data involved included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers such as passports and state ID cards, and financial information such as account numbers and credit or debit card numbers.
RYBD published a Notice of Incident on its website dated June 26th, 2026, confirming that on October 12th, 2025, the firm detected unauthorized access to one of its backup servers and activated its incident response plan, engaging outside cybersecurity and legal professionals. Notably, while RYBD’s own notice indicates unauthorized access was detected on October 12th, 2025, the Texas Attorney General filing lists the breach discovery date as May 27th, 2026—a gap of more than seven months. This discrepancy may reflect that while initial unauthorized access was detected in October 2025, the full scope of the data compromise was not determined until May 2026. Separately, the Akira ransomware group claimed RYBD as a victim on November 11th, 2025, according to Ransomware.live; this is an attacker-side allegation recorded on a leak site and has not been confirmed by RYBD or any regulator—RYBD’s own notice does not reference ransomware or name a threat actor. No prior breaches or class action lawsuits connected to this incident were identified as of August 2026.
Key Facts at a Glance
- Company or Organization: Rhodes, Young, Black, and Duncan
- Industry: Accounting / CPA Firm (categorized as Financial Services in the TX AG filing)
- Location: Duluth, Georgia
- Incident type: Unauthorized access to a backup server
- Date of breach: September 17th, 2025 – October 12th, 2025
- Date breach discovered: May 27th, 2026
- Date of consumer notification: June 26th, 2026
- Total persons affected: 3,650
- Litigation status: No class action lawsuits or public litigation connected to this incident were found as of August 2026
- Source: Texas Attorney General Data Security Breach Report, BR-0005279 (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005279); RYBD Notice of Incident (https://rybd.com/notice-of-incident/)
What Should You Do?
If you received a notice from Rhodes, Young, Black, and Duncan, take steps now to protect yourself. Place a fraud alert or credit freeze with each of the three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for someone to open new accounts in your name. You can obtain free copies of your credit reports at AnnualCreditReport.com and review them carefully for unfamiliar accounts or activity. Monitor your existing bank and financial accounts for any unauthorized transactions. Because Social Security numbers and financial account information were involved, the risk of identity theft is elevated; visit IdentityTheft.gov if you suspect your information is being misused. Contact Almeida Law Group if you have questions about your rights or options.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
