Anatomy of a CPA Firm Breach: One Stolen Login, Start to Finish

What follows is an illustration, not an account of one particular client. The mechanics are the ones used against small accounting practices every filing season. We have set it at a 12-person firm and walked it through in order, because seeing the sequence makes it clear where the attack could have been stopped.

The breach, stage by stage

Stage one: homework. This takes roughly twenty minutes. The firm’s website supplies names, titles, and the pattern its email addresses follow. LinkedIn identifies the staff accountants and, usefully, whoever was hired recently, since new employees click more. A year-old job ad that reads “experience with CCH Axcess a plus” reveals the software in use. If the client portal lives at a subdomain anyone could guess, that goes in the notes as well.

Stage two: the lure. There are four that turn up again and again:

• A notice dressed up as coming from the IRS or e-Services: “your EFIN needs re-verification”
• An ordinary credential phish: “your password expires today,” “your mailbox is full”
• A supposed “new client” sending over documents, a ploy the IRS has warned tax professionals about by name
• A counterfeit alert from the tax software vendor: “update required before filing season”

Say a staff accountant, three weeks into the job and buried in organizers, clicks the new-client link. The sign-in page she lands on is an exact copy of Microsoft 365. She types her password. If the attacker is passing the login through to Microsoft as she types, she may hand over her MFA code too. Either way, the account now belongs to someone else.

Stage three: the mailbox. Firms tend to underrate this stage. A mailbox opens nearly everything else. After signing in, the attacker creates a rule that silently deletes any incoming reply containing “hacked” or “phishing.” Next comes the sent folder, which shows how people at the firm write: who closes with “Best,” who is on first-name terms with which clients. Then the password resets begin, for the tax software, the document management system, and the client portal. Each reset link is delivered to an inbox the attacker controls. Any system that trusts the firm’s email has just extended that trust to an intruder.

Stage four: spreading out. The client list gets copied. The attacker may also phish from the inside. Picture a note to the bookkeeper sent from the managing partner’s genuine account: “Send me the payroll export for [client name].” The address is correct and the request fits the season, so the bookkeeper sends it. Weeks can pass like this. In our illustration it is six, and nothing looks wrong to anyone at the firm.

Stage five: cashing in. The usual options number four.

• Take the firm’s EFIN and submit fraudulent returns under the firm’s own identity. The IRS has issued warnings specifically about EFIN theft.
• Download several thousand returns without drawing attention, then file for fraudulent refunds ahead of the real taxpayers.
• Set off ransomware on the Friday before April 15, the point at which a firm is under the most pressure to pay.
• Run a business email compromise. The attacker replies to everyone on a live client thread with “updated wire instructions.” Since the message sits inside a genuine conversation, it succeeds alarmingly often. Reported BEC losses run to roughly $2.8 billion a year according to the FBI’s IC3, and unreported losses are not in that number.

One real event belongs alongside the illustration. In May 2019, Wolters Kluwer, the company that makes CCH, suffered a malware attack that was widely reported as ransomware. Its tax software was unavailable for days in the middle of filing season, affecting firms around the world. A firm can keep its own house in order and still be stopped by a problem at its software supplier.

Why a firm this small is worth the effort

Headcount does not interest an attacker. The amount of usable data per target does, and few targets are as concentrated as a CPA firm. Look at what one Form 1040 holds: a Social Security number, a date of birth, an address, an employer, income, dependents and their SSNs, the bank and routing numbers on the direct deposit line, and a signature. On criminal marketplaces the term for this is a “fullz,” meaning a full identity kit, and a tax return is the most complete one available. Compromise one firm and you may collect thousands of them at once.

The calendar helps the attacker too. During tax season everyone is working against a deadline. Staff click quickly, open whatever is labeled “client docs,” and let the verification call slide. Criminals plan around those weeks the way a florist plans around Valentine’s Day.

Then there is the state of the defenses. A typical firm under 50 people has no security employee. IT belongs to an outside provider, “security” means an antivirus subscription, and no policy exists on paper. The IRS has been blunt about this for years through its Security Summit. Tax professionals are a top target, and each year the agency receives a few hundred reports of data theft from them, any one of which may expose hundreds of clients.

What the attacker leaves with

• The firm’s EFIN
• Every 1040, which means a complete identity kit for each client, spouse, and dependent
• W-2s and 1099s showing wages
• Bank information taken from organizers and direct deposit forms
• Records for business clients: general ledgers, financial statements, payroll registers, EINs, and officers’ SSNs
• The whole email archive, covering years of client correspondence and attachments

Your clients bear what comes next. Returns are filed fraudulently under their names, and the refunds they are owed get frozen. The IRS has gotten better at resolving identity theft cases, but it remains slow. In its most recent report, the National Taxpayer Advocate measured average resolution time at about 22 months. Consider what it would take to phone every client on your list with that news.

What putting it off until after April 15 costs

With regulators. Under the FTC’s amended Safeguards Rule, in force since June 2023, a tax preparation firm is classified as a financial institution. The rule turns several things into legal requirements: a written information security program (WISP), a designated qualified individual, MFA, encryption, vendor oversight, and an incident response plan. These are no longer optional good practice. IRS Publication 4557 and the PTIN renewal process press the same obligations. If you are breached, regulators will treat a firm that has a WISP on file very differently from one that has none.

In dollars. The newest IBM Cost of a Data Breach Report gives a global average of $4.44 million, and $5.56 million for financial services. A small practice will not reach those totals. Even so, the forensic investigation for a modest incident commonly costs $30,000 to $100,000 or more. Notification letters, credit monitoring, legal fees, and the tax-season billings lost while systems are down all come on top of that.

In client confidence. People give their accountant everything because they trust the accountant with everything. In a small market a breach makes the local news, and client retention afterward is grim.

Verizon’s Data Breach Investigations Report reaches the same finding every year: roughly 60% of breaches involve a human element. For professional services firms, the pattern is dominated by phishing and stolen credentials. Nobody is defeating the firewall. The attacker is simply counting on your staff being too busy to look twice.

Eight controls that break the chain

The good news is that ordinary controls stop the attack described above at several different stages. Roughly in order of how much each one matters:

1. MFA everywhere, beginning with email and the tax software. Use an authenticator app, not SMS. For most run-of-the-mill attackers, this alone defeats stage two.
2. A written call-back rule. A wire, a change of bank details, or any out-of-the-ordinary request gets confirmed by phone, using a number already on file. Put the rule in writing. “The partner’s in a hurry” is not grounds for skipping it.
3. Training that uses real lures. Put the actual “EFIN verification” and “new client” emails now circulating in front of your staff, and run simulations. Someone who has seen the trick before will recognize it.
4. Patching and closing off entry points. Remote desktop should never face the internet. Keep firewalls and VPNs current. Replace legacy antivirus with modern endpoint detection.
5. Backups kept offline or immutable, with restores tested. Until you have restored from a backup, you only believe you have one.
6. A written WISP. The law requires it regardless, and the IRS publishes a free template in Publication 5708. An afternoon is enough to get started.
7. Vendor vetting. Ask each software provider what incidents it has had and what controls it runs. The Wolters Kluwer outage showed that a vendor’s risk becomes yours.
8. A call list made ahead of time. That means an incident response contact, your cyber insurance carrier, and quick reporting: the IRS Stakeholder Liaison when tax data is stolen, and the FBI’s IC3 for anything else. How fast you move really does affect how it ends.

A security department is not required for any of these, and neither is a six-figure budget. What is required is a decision that deadline pressure, which attackers are relying on, will not stand in for a security plan. The firms that end up hurt could generally have afforded protection. They had concluded that a practice their size would not attract attention.

It does. If you would like someone else to check before busy season, we do that work: a WISP review, a phishing simulation, or a frank assessment of where an attacker would begin with your firm.

CPA firms: the time to call us is before busy season, not after an incident. Our short exposure check asks about email, MFA, backups, vendors, and your WISP, which are the first places an attacker would test. It takes about three minutes.

→ Check your firm’s exposure · Book a consultation