After a breach: How tax preparers should respond to being hacked

October 23, 2018 9:06 AM

The worst has happened: Hackers got to your system or maybe you left your iPad on the plane – and client information is gone. In this age of electronic business, few feelings of panic equal this moment.

But if you act quickly, you can help stop bogus returns from being filed in your clients’ names.

Tax preparers who suffer a data theft should report the incident immediately and follow an established process to protect their clients, whether they’ve been hit by cybercriminals, theft or accident. Here’s who to contact – and as fast as possible.

Internal Revenue Service federal building Washington DC USA

The IRS

Report client data theft first to local IRS stakeholder liaisons, who will notify the Criminal Investigation division and others within the agency.

Law enforcement

Also contact local offices of the Federal Bureau of Investigation and the Secret Service, as well as local police to file a report. Speed is critical.

laptop fingerprint with crime scene tape across it

zimmytws - Fotolia

The appropriate states

Any breach of personal information could have an effect on the victim’s tax accounts with the states, as well as with the IRS. The Federation of Tax Administrators has created a page with state-by-state listings of who to contact after a data loss. Also contact the attorney general for each state in which returns are prepared.

a young man in suit in his office showing an insurance policy and pointing with a pen where the policyholder must to sign

nito - Fotolia

Your insurance company

Report the data loss to the appropriate insurance company and check if your insurance policy covers data breach expenses. They may also be able to provide help in remediation, and to give you advice on how to proceed.

olly - Fotolia

Experts

Consult a cybersecurity expert who can help determine the cause and scope of the breach, stop the breach, and then prevent further breaches from occurring.

Agencies and bureaus

The Federal Trade Commission offers general guidance on data loss, from how to question those who discovered the breach to when to call in lawyers. For more individualized guidance, contact the FTC at idt-brt@ftc.gov.

Laptop computer with crime scene tape across it

zimmytws - Fotolia

Credit monitoring and ID theft protection agencies

Some states require tax preparers to offer credit monitoring and ID theft protection to victims of ID theft; if that’s the case in your state, contact credit and ID-theft protection agencies.

Data breach concept image with business icons and

Fotolia

Clients

Send an individual letter to all victims to inform them of the breach – but work with law enforcement on when to send that letter so it doesn’t inadvertently hinder any investigation that may be under way.