What do accounting firms in New York show from outside?

What share of accounting firms in New York show each sign?

The last column is the same figure across every firm in this data set, for comparison.

Which breach laws for New York have we read from their own text?

Each page below reads one law from its own text and quotes it, with the date we read it. Which of them applies to a firm depends on what it does and the information it holds.

• New York data breach notification law

What should a firm in New York check first?

1. Look up your DMARC record.It is a TXT record at _dmarc followed by your domain. If there is none, or it says p=none, mail servers are not told to refuse email forged in your name.
2. Move the policy to p=quarantine and then p=reject.Do it once your reports show that every service sending email for you passes.
3. Look for registered names one character away from your domain.A look-alike that is live can carry a changed invoice or new bank details in your name.
4. Agree a call-back rule for any change of bank details.Confirm it by phone on a number you already hold, never on one given in the message.
5. Change the password of any shared address, such as info@, that appears in breach data.Turn on multi-factor sign-in for it and for every other mailbox.

• Email records, step by step at each DNS host
• What to do about a domain that looks like yours

How were these figures counted?

Every figure is counted from our own outside readings of public records. No system was accessed and no log-in was used.

Each firm counts once, at one finished reading, as a rule its most recent. Test, demonstration and seeded records, readings of households, our own domains and firms that asked not to be counted are left out.

A firm's place is the province or state, and the city, recorded with its reading. A city is counted only where it is in our table of named cities.

A firm counts towards a figure only where that check returned an answer. A lookup that went unanswered is not counted as a missing record.

A look-alike is counted by the method of our look-alike study: a registered, live name made from the firm's domain that does not point at the firm's own server and is not the same name on another ending.

An address is counted only where every lookup in the breach databases answered. It does not mean the firm itself was breached.

A province, state or city is published only where the firms read there number at least 100, and a line of work in a province or state only where they number at least 50. A figure is shown only where as many firms answered its check. Where a figure could be worked out by subtraction from the province's or state's own, the smallest one is left out as well.

These are the firms LeakTrace has read from outside. They are not a census of the place, and being counted does not make a firm a client.

The figures were computed on 17 October 2026 by one command and stored with their date. This page shows the stored figures and computes nothing when it loads.