Data Breach Information

Data theft is a very real threat to professional tax preparers, accountants, and bookkeepers. The type of personal information you deal with on a regular basis is very valuable to hackers and criminals: Social Security Numbers, banking details, EINs, and more can be used for identity theft and to breach and steal from sensitive accounts.

If you or your tax business have been impacted by data or information theft, it’s vital to deal with the problem thoroughly and efficiently and get the right cybersecurity in place to stop it from happening again. Here’s what you need to do in the event of a breach.

1. Establish how your business has been impacted by data theft

The first thing to do is to understand whether you’ve actually had tax, accounting, or client data stolen. Once you find out about possible theft, you must investigate and analyze the following areas.

What type of data breach was it?

• Social engineering: This is when a criminal pretends to be someone that a tax employee trusts and convinces the employee into handing over their login and password information. An attacker may be posing as IT support, a colleague, or someone else.
• Brute force attack: Hackers run all sorts of combinations of logins and passwords against your internal systems and break in due to weak login and password combinations.
• Vulnerability exploit: Some software has inherent security flaws and vulnerabilities, that if left unpatched allows an attacker to take advantage and get into the system.

What information was stolen?

Did the attackers get client tax records, SSNs, banking details, internal business information, or something else? Once you know the breadth and depth of the accounting data breach, you can handle it more effectively.

When did the breach happen?

The attackers may have been in your systems for some time. You should find out when your security was compromised and how long they had access to your data.

2. Contact relevant parties

You must notify the correct parties as soon as possible, including official tax agencies and related organizations, your local police, the FBI, the Secret Service, and the local state agency responsible for tax filings and payment. Also notify your insurance company, the Federal Trade Commission, credit and identity theft protection agencies, and credit scoring bureaus.

3. Prevent future theft

Once you’ve dealt with the breach and notified the relevant parties, work with cybersecurity specialists to reduce the possibility of this happening again. Get security tools in place, train your staff, patch any vulnerabilities, and carry out penetration testing and vulnerability scanning on your systems.