Discovering a breach in the middle of tax season is every firm owner’s nightmare. What you do in the first day matters more than anything afterward. This is the order we walk clients through.

This is general guidance, not legal advice. Involve your attorney and your insurer early.

Hour 0 to 1: contain it

  1. Disconnect, do not destroy. Unplug the network cable or turn off Wi-Fi on affected computers. Do not wipe, reinstall or “clean up” anything yet.
  2. Do not pay or reply. If there is a ransom note or a suspicious email thread, leave it in place and do not engage.
  3. Call your IT provider. They can isolate machines remotely, block compromised accounts and check whether the attacker is still inside.

Hour 1 to 4: bring in help and lock accounts

  1. Call your cyber insurer. Many policies require you to use their approved incident response firm and lawyers. Calling a random vendor first can complicate the claim.
  2. Change passwords from a clean device. Email, tax software, the client portal, banking and payroll first. Confirm multi-factor authentication is on for all of them.
  3. Check e-filing activity. Signs of tax data theft include more e-file acknowledgments than returns you filed, client returns rejected because the Social Security number was already used, and clients receiving IRS letters for returns they did not file.

Hour 4 to 24: report

  1. Report to your IRS Stakeholder Liaison. The IRS asks tax professionals to report client data theft to their local Stakeholder Liaison immediately. The liaison alerts IRS Criminal Investigation and others, and quick reporting lets the IRS block fraudulent returns in your clients’ names.
  2. Email the Federation of Tax Administrators at StateAlert@taxadmin.org for instructions on reporting to state tax agencies.
  3. Contact law enforcement if your attorney or insurer advises it, typically your local FBI field office.
  4. Preserve evidence. Keep logs, the ransom note, suspicious emails and a written timeline of who did what and when.

Days 2 to 30: notification

Notification rules depend on what was taken and where your clients live. A few that matter for firms in our area:

  • FTC Safeguards Rule: firms must notify the FTC within 30 days of discovering an event involving unencrypted information of 500 or more consumers.
  • Washington: notice to affected residents in the most expedient time possible and no more than 30 days after discovery, plus notice to the Attorney General when more than 500 Washington residents are affected.
  • Idaho: notice to affected residents in the most expedient time possible and without unreasonable delay, once an investigation finds misuse has occurred or is reasonably likely.

Firms near the state line often have clients in both states, so expect to follow both sets of rules.

Recovery

Restore from clean, tested backups rather than trying to disinfect infected machines. Reset every account, review who had access to what, and fix whatever let the attacker in before you reconnect. Then update your incident response plan with what you learned.

The best time to plan is now

Every step above is faster when it is written down in advance: who to call, insurer contact details, your Stakeholder Liaison, and where backups live. That plan is part of the Written Information Security Plan every paid preparer is required to keep, and it is exactly what our sister firm Sunesis Services builds.

If something is happening right now, call us at 509-530-1411.