Think Your Tax Practice Is Too Small for a Cyberattack?

"Why would a hacker come after my little tax practice?"

Good question.

You only have 500 clients. Maybe 300. You're not H&R Block. You're not a Fortune 500 company.

Why would anyone care about you?

Because you have something incredibly valuable.

Your clients' lives.

Names. Addresses. Social Security numbers. Dates of birth—driver's licenses. Bank accounts. W-2s. 1099s. Business information.

Put enough of that together, and you don't have a tax return.

You have an identity-theft starter kit.

And criminals know it.

These Aren't Hypothetical Tax Firm Breaches

Consider some reported breaches involving tax and accounting organizations from late 2025 through 2026 from the Texas Attorney General and public information:

That's more than 8,000 people associated with breaches reported by just these private tax and accounting organizations.

And look at the information involved.

Social Security numbers.

Driver's-license numbers.

Banking and other financial information.

Dates of birth.

Government identification.

Health-insurance information.

Even medical information.

That isn't marketing data.

That's the good stuff.

The Number That Should Scare You Is 21

The biggest breach on this list involved 3,725 people.

That's not the number I want you thinking about.

I want you thinking about 21.

Butler Tax & Accounting reported a breach affecting just 21 individuals.

Twenty-one.

You don't need 10,000 clients.

You don't need 100 employees.

You don't need multiple offices.

You don't even need a full-time IT department.

You need information worth stealing.

If you're a tax professional, congratulations.

You have it.

"But We Have Antivirus."

Good.

Do you have multifactor authentication everywhere it should be?

Who has administrator access?

When someone leaves your firm, how quickly is access terminated?

Are computers encrypted?

Are security patches and updates being installed automatically?

Is your backup running and tested?

Do employees use their personal equipment?

What happens if or when someone clicks the wrong link?

Wouldn't it be unfortunate to discover the answers to those questions after somebody gets into your system?

Cybersecurity isn't one product.

It's a system of safeguards.

And Then There Is Your WISP

Tax and accounting professionals should already be familiar with the Written Information Security Plan (WISP).

But there is an enormous difference between:

"We have a WISP."

and

"We are engaged, and our WISP is a living document"

You can have the world's greatest cybersecurity PDF policy sitting in a three-ring binder.

The hacker will not be impressed.

Cybersecurity Is Not an IT Problem

That's where many tax professionals get this wrong.

Cybersecurity isn't something you dump on your computer person.

It is a business risk.

If a breach occurs, IT may be fixing computers.

You're dealing with clients.

You're dealing with insurance.

You're determining what information was compromised.

You're figuring out notification requirements.

You're potentially talking to attorneys, regulators, and law enforcement.

And you're trying to run your tax practice at the same time.

February might be a particularly inconvenient month to discover your cybersecurity plan consisted of:

"Call the outsourced IT guy."

Do Not Be Afraid, Take Action

Tax professionals should not hide under their desks and unplug the internet.

It is not if, but when, so start with a WISP and then expand it. Plug the holes.

Because the lesson from these breaches isn't that large tax firms get attacked.

It isn't even that small tax firms get attacked.

It's much simpler.

Tax professionals possess some of the most valuable personal information a criminal can steal.

Your firm doesn't need to be big enough to attract their attention.

Your data already is.