Data theft is a very real threat to professional tax preparers, accountants, and bookkeepers. The type of personal information you deal with on a regular basis is very valuable to hackers and criminals: Social Security Numbers, banking details, EINs, and more can be used for identity theft and to breach and steal from sensitive accounts.
If you or your tax business have been impacted by data or information theft, it’s vital to deal with the problem thoroughly and efficiently and get the right cybersecurity in place to stop it from happening again. Here’s what you need to do in the event of a breach.
1. Establish how your business has been impacted by data theft
The first thing to do is to understand whether you’ve actually had tax, accounting, or client data stolen. Once you find out about possible theft, you must investigate and analyze the following areas.
What type of data breach was it?
There are a few different ways a hacker could gain access to a business, including:
- Social engineering — This is a criminal pretends to be someone that a tax employee trusts and convinces the employee into handing over their login and password information. An attacker may be posing as IT support, a colleague, or someone else.
- Brute force attack — Hackers run all sorts of combinations of logins and passwords against your internal systems and break in due to weak login and password combinations.
- Vulnerability exploit — Some software has inherent security flaws and vulnerabilities, that if left unpatched allows an attacker to take advantage and get into the system.
What information was stolen?
Did the attackers get client tax records, SSNs, banking details, internal business information, or something else? Once you know the breadth and depth of the accounting data breach, you can handle it more effectively.
When did the breach happen?
The attackers may have been in your systems for some time. You should find out when your security was compromised and how long they had access to your data.
Other areas you can look at are who the attackers were, where did the attack originated, and any weaknesses you still have in your cybersecurity. If you don’t have the in-house expertise to get details on the breach, you can hire data breach and security specialists who can investigate on your behalf and help you protect yourself in the future.
2. Contact relevant parties
You must notify the correct parties as soon as possible, including:
Official tax agencies and related organizations
- The Internal Revenue Service via local stakeholder liaisons
- Your local police
- The local offices of the FBI and the Secret Service
- The local state agency responsible for tax filings and payment, together with the State Attorneys General
Other official organizations
- Your insurance company to check if your policy covers you for data breaches.
- The Federal Trade Commission to provide guidance on how to proceed.
- Credit and identity theft protection agencies that you offer credit monitoring and identity theft protection to victims of data and identity theft. Certain states require these.
- Credit scoring bureaus – let them know there is a compromise and clients may seek their services.
Your clients
Finally, you will need to contact your clients and let them know. You should be honest and transparent. Explain the data that was stolen, the impact it might have, what you are doing about the breach, and what your clients need to do. Recommend that they put a freeze on various accounts, change their passwords, and offer them a credit and ID monitoring service.
You may also direct them to IdentityTheft.gov, an online resource powered by the Federal Trade Commission, where individuals can report identity theft and establish a personal recovery plan. The site includes step-by-step guidance, streamlined checklists, and pre-filled letters and forms for victims.
3. Prevent future theft
Once you’ve dealt with the breach and notified the relevant parties, work with cybersecurity specialists to reduce the possibility of this happening again. Get security tools in place, train your staff, patch any vulnerabilities, and carry out penetration testing and vulnerability scanning on your systems.
Looking for an identity theft protection solution to protect your clients from a tax data breach? Our experts at TaxSlayer Pro are proud to offer SecurelyID, the leading identity theft protection solution. Call us today at 1-888-420-1040 to learn more.
