A Florida resident has filed a proposed nationwide class action in New Jersey federal court accusing accounting firm Mercadien PC of failing to implement reasonable safeguards to protect client private information, allowing a September cyberattack to expose sensitive data of thousands.

Anthony Delgado alleges Mercadien discovered the breach in November but waited until last week to notify affected individuals — leaving them without key details on what data was stolen, what malware was used, or what steps the firm is taking to prevent future incidents.

"Representative plaintiff and class members are thus left to speculate as to where their private information ended up, who has used it and for what potentially nefarious purposes," the complaint states. "Indeed, they are left to further speculate as to the full impact of the data breach and how exactly defendant intends to enhance its information security systems and monitoring capabilities so as to prevent further breaches."

The exposed data potentially includes names, addresses, dates of birth, driver's license/government ID/Social Security numbers, financial account information, usernames/passwords, IRS personal identification numbers, and payment card details for a limited number of people.

Delgado claims Mercadien collected this sensitive information in exchange for professional services and therefore had a duty to maintain adequate encryption protocols, policies, and procedures — even for internal use — to prevent unauthorized access.

The proposed class covers anyone in the U.S. whose private information was exposed in the breach. Claims include negligence, breach of implied contract, and breach of the implied covenant of good faith and fair dealing. Delgado seeks actual, nominal, and consequential damages, prejudgment interest, and attorney fees/costs.

Representatives for Mercadien and Delgado did not immediately respond to requests for comment Tuesday.

Delgado is represented by Avi Mermelstein of Arenson Dittmar & Karban and Scott Edward Cole of Cole & Van Note. Counsel information for Mercadien was not immediately available.

The suit joins a growing wave of class actions targeting professional firms for data security lapses — especially when sensitive financial/tax information is involved — highlighting ongoing risks of delayed breach notifications and inadequate safeguards in an era of rising cyberattacks.