Assurbyte Book a free call
Menu

Tax Preparer Data Breach: What to Do and Who to Notify

· Assurbyte

A calm office desk with a calculator, printed reports and a laptop, beside the headline: Data breach? What to do and who to notify.

If you've had a tax preparer data breach, do three things in this order: stop the leak, call your local IRS Stakeholder Liaison, and then work through the rest of the call list (law enforcement, states, your insurer, clients, and the FTC if 500 or more people are affected). Speed matters most with the IRS call, because it can help block fake returns filed in your clients' names. If nothing has gone wrong yet, even better. Grab a coffee, read this while it's calm, and turn it into a one-page plan.

Nobody plans to get hacked in the middle of tax season. It usually doesn't look like a movie, either. It's a staff member clicking a convincing "your mailbox is full" email, a laptop left in a car, or ransomware (a program that locks your files and demands money to unlock them). Ordinary Tuesday stuff. What happens next is what you control.

What are the signs of a tax preparer data breach?

The IRS lists warning signs that client data may have been stolen. A few of the big ones:

  • A client's e-filed return gets rejected because a return was already filed with their Social Security number.
  • Clients get IRS letters about returns they never filed.
  • More returns show up under your EFIN or PTIN than you actually filed. (Your EFIN is your Electronic Filing Identification Number, and your PTIN is your Preparer Tax Identification Number. Think of them as your e-file ID badge and your preparer ID badge.)
  • Computers acting strangely: the cursor moving on its own, machines running slower than normal, or staff getting locked out.

IRS Publication 4557 suggests checking your EFIN return totals weekly (PTIN totals are available to certain credentialed preparers who file 50 or more returns). It's like glancing at your bank app for charges you don't recognize. Thirty seconds, and it can catch trouble early. If you want the rest of Pub 4557 in checklist form, see our Pub 4557 checklist for small tax offices.

What do you do first if your tax office is hacked?

Stop the leak, but don't destroy the evidence.

  • Change passwords on the affected accounts, using a clean device, not the one you think was hacked.
  • Turn on MFA (multi-factor authentication) everywhere you can. MFA is a second lock on the door, like a code texted to your phone, so a stolen password alone isn't enough. Here's where small offices most often miss MFA.
  • Unplug infected computers from the network.
  • Don't wipe anything. Leave it the way you'd leave a broken window for the police to see. A security professional needs that evidence to figure out what happened and how far it spread.
Three steps after a tax preparer data breach: contain by unplugging infected computers and changing passwords from a clean device, notify the IRS Stakeholder Liaison, states, insurer and clients, and recover by fixing the cause and updating the WISP and incident plan.

How do you report data theft to your IRS Stakeholder Liaison?

This is the call that matters most, and most people don't know it exists. The IRS tells tax pros to report client data theft to their local IRS Stakeholder Liaison. The liaison passes it to IRS Criminal Investigation and other teams for you. In the IRS's own words: "Speed is critical. If reported quickly, the IRS can take steps to block fraudulent returns from being filed using your clients' personal information."

Find yours on the IRS Stakeholder Liaison contacts page by state. And skip the regular IRS phone line for this one. The IRS says its toll-free assisters can't accept third-party reports of tax-related identity theft. Save yourself the hold music.

Which law enforcement and state agencies do you notify?

The IRS data theft checklist for tax professionals lists:

  • Your local FBI office.
  • Your local Secret Service office, if directed.
  • Local police, to file a report.
  • For ransomware, Pub 4557 also says to contact the FBI and CISA (the Cybersecurity and Infrastructure Security Agency, the federal government's cyber defense team).

States come next. A breach can hit your clients' state tax accounts too. The Federation of Tax Administrators keeps a state tax agency breach-reporting contact list. The IRS also says to check whether you need to notify the state attorney general in each state where you prepare returns, and notes that most states require it. Each state has its own timing rules, so this is one to check with counsel.

When do you report a tax preparer data breach to the FTC?

Here's where the FTC Safeguards Rule comes in. (That's the Federal Trade Commission's data protection rule for "financial institutions," and yes, paid tax preparers count. Here's how the FTC Safeguards Rule applies to tax preparers.)

Since May 13, 2024, the rule says: if unencrypted customer information on 500 or more people is taken without permission, you must notify the FTC as soon as possible, and no later than 30 days after you discover it. The notice goes through an online form on the FTC's website. It asks for your contact details, what kinds of information were involved, the date range if you know it, how many people were affected, and a general description of what happened. (16 CFR 314.4(j), the FTC notice rule)

Two details trip people up:

  • The clock starts early. The event counts as "discovered" on the first day anyone at your firm knows about it, other than the person who caused it. Not the day the investigation wraps up.
  • "Unencrypted" matters. Encryption scrambles data so it's gibberish without a key. If data was encrypted and the key wasn't taken, it isn't a "notification event" under this rule. State laws have their own definitions, though.

This FTC rule also applies to small firms. The Safeguards Rule's small-firm exception (for firms holding customer information on fewer than 5,000 consumers) drops some paperwork, but not the FTC notice.

When do you tell your insurer and your clients?

  • Your insurer: The IRS lists your insurance company as a call to make, "to report the breach and to check if your insurance policy covers data breach mitigation expenses." Many policies have their own notice deadlines, so read yours.
  • Your clients: The IRS recommends an individual letter to each affected client, timed with law enforcement. Clients should file IRS Form 14039, the Identity Theft Affidavit, only if they get an IRS notice or their e-filed return is rejected as a duplicate.
  • Credit bureaus and ID protection: The IRS notes some states require offering credit monitoring or identity theft protection to victims.

Then find out how it happened and fix it before you're back to business as usual. Pub 4557 covers recovery steps. Write down what you learned, and update your WISP (your written information security plan) and incident plan to match. Here's what the incident section of a WISP should cover.

Why does your insurance company care about your plan before a breach?

Because the bad day is the worst day to discover you didn't know your policy. Insurers may ask about things like MFA, backups, and whether you have a written security plan, both on applications and when you make a claim. If your answers say "yes," your office should actually match them.

So do a five-minute check now: find your policy, write down the claim phone number, note any notice deadline, and reread what you told the insurer. That alone puts you ahead of the panic.

What goes in a one-page breach plan?

Print it. A hacked computer is a bad place to look up phone numbers.

  1. Who in the office decides, and who calls whom.
  2. Your IRS Stakeholder Liaison's contact info.
  3. State tax agency and attorney general contacts for every state you file in.
  4. Your local FBI office and police non-emergency number.
  5. Your insurer's claim line and policy number.
  6. Your IT person and a security professional.
  7. A reminder: 500 or more people affected means FTC notice within 30 days of discovery.

How Assurbyte can help

You can build all of this yourself. The IRS gives you the pieces for free. But be honest about the time: tracking down contacts for every state you file in, writing an incident plan that fits your office, checking your MFA and backups, and lining it all up with your WISP is a lot of evenings, and evenings get scarce once January hits.

That's what our done-for-you Safeguards Readiness Package is for. We review your setup, give you a plain-English gap list, and write your WISP for you, including an incident response plan and an FTC notification procedure built around how your office actually works.

What you get out of it:

  • Time back. You answer questions; we do the writing.
  • Ready before tax season, not scrambling during it.
  • Calmer answers for your insurer, because your plan and your office tell the same story.
  • A real plan for the bad day, so you're making phone calls, not searching for phone numbers.

FAQ

Do I report to the IRS if fewer than 500 people are affected?

Yes. Reporting client data theft to your IRS Stakeholder Liaison isn't tied to the FTC's 500-person threshold. Report quickly, whatever the size.

Is a lost, encrypted laptop a data breach?

Under the FTC rule, notice applies to unencrypted information (or encrypted data where the key was also taken). State laws vary, so check each state's rules and keep a record showing the laptop was encrypted.

How fast do I have to notify the FTC?

If unencrypted information on 500 or more people is involved, as soon as possible and no later than 30 days after discovery.

Should my clients file Form 14039 right away?

No. Only if they get an IRS notice or their e-filed return is rejected as a duplicate.

Not sure where your office stands?

Start with our free Small Office Security Checkup. It takes a few minutes, and every "no" shows you a gap to close. If you'd rather hand the whole thing off, take a look at the Safeguards Readiness Package.

This is general information, not legal advice. For legal questions, talk with your own attorney. Assurbyte helps offices get ready; we don't give legal sign-off.

Sources