BLOG

650,000 Tax Returns on One File Server: What a Ransomware Claim Against a Tax Firm Should Teach Every CPA Office

November 5, 2026

Last week, a ransomware group posted a claim that should get the attention of every accounting and tax office, no matter the size. On October 29, 2026, the Rhysida ransomware group listed INTAX, Inc., a property-tax compliance and bill-pay firm in Lexington, Kentucky, on its leak site. The group says it took the firm's "complete file server": about 1.27 TB across 892,867 files.

To be clear up front: this is a claim from a criminal group. As of the latest public reports, INTAX has not confirmed an incident, no sample of the data has been independently verified, and law firms have opened investigations into what happened. Ransomware groups exaggerate, and we may learn the real picture is different. But the list of what the group says it found is worth reading slowly, because it reads like an inventory of what sits on a lot of file servers in a lot of offices.

What the group says it found

According to the leak-site listing, as recorded by the tracker Ransomware.live and repeated by the security blog HookPhish, the group claims the stolen data includes:

  • 649,905 PDFs it describes as client tax returns
  • More than 100 QuickBooks company files, which the group says hold full ledgers, bank details, and payroll
  • Bank account and routing numbers, plus wire paperwork
  • Identity documents for the owner and employees, including passports, a driver's license, W-2s with Social Security numbers, and medical insurance cards
  • 60+ files of passwords stored in plain text, including logins for government tax portals and the firm's own QuickBooks
  • More than 24,000 emails and personal employee folders

Again, none of that is verified. But notice that almost nothing on the list required a sophisticated attack to be valuable. It is ordinary office data, collected over years, sitting in one place.

Lesson 1: Data you no longer need is still data you can lose

Nearly 650,000 return files is not one tax season's work. Whatever the real number turns out to be, most firms that have been around a while have folders of returns, scans, and client workpapers going back far longer than anyone needs them. Nobody deletes them because nobody is assigned to.

The problem is that old files don't get less sensitive with age. A Social Security number from a 2014 return is just as useful to a criminal today. Every year of records you keep past your actual retention requirement is another year of exposure if something goes wrong.

This isn't just good advice, either. The FTC Safeguards Rule, which applies to tax preparers and accounting firms, requires procedures to securely dispose of customer information no later than two years after it was last used to serve that customer, unless you have a legitimate business need or a legal requirement to keep it, and it requires you to review your retention policy periodically. Practical steps:

  • Set a written retention schedule with your CPA or attorney: how long you keep returns, workpapers, and source documents, and why.
  • Assign someone to actually purge or archive on that schedule each year, after tax season is a natural time.
  • Move anything you must keep but rarely touch to encrypted, access-restricted storage instead of the everyday shared drive.

Lesson 2: A password file is a skeleton key

Of everything in the claim, the "60+ cleartext password files" may be the most avoidable. We understand how it happens. A firm juggles logins for IRS e-Services, state revenue portals, county and parish tax sites, banks, and client systems. Someone starts a spreadsheet or a text file called "passwords" to keep it all straight, and it ends up on the shared drive.

Once an attacker is on your network, that file turns one break-in into access to every portal on the list. It can also be used to file returns, change bank details, or impersonate your firm with the agencies you deal with every day.

  • Use a business password manager with individual user accounts, so each person only sees the logins they need and access can be removed the day someone leaves.
  • Search your file shares for password files (names like "passwords," "logins," "creds") and get them off the network after moving the contents into the password manager.
  • Change any password that has ever lived in one of those files. Assume it was seen.

Lesson 3: Turn on multi-factor authentication everywhere it exists

Multi-factor authentication (MFA) is the step that makes a stolen password far less useful on its own. For tax and accounting firms it is no longer optional: the FTC Safeguards Rule requires MFA for any individual accessing any information system, unless your designated security lead approves an equivalent or stronger control in writing. That includes email, remote access, your tax software, your accounting software, and government portals that offer it.

Lesson 4: Don't let one server hold everything

The group calls what it took a "complete file server." Whether or not that's accurate, a lot of small offices really are set up that way: one shared drive where client returns, payroll, HR records, and the owner's personal documents all live side by side, open to everyone on staff.

  • Segment and restrict. Client tax data, HR and payroll, and firm management files should be separated, with access limited to the people who need each one. The Safeguards Rule calls for limiting users' access to only the customer information they need for their jobs.
  • Encrypt sensitive data at rest and in transit. The Safeguards Rule requires this too, or an approved compensating control.
  • Keep backups that an attacker can't reach: offline or immutable copies, tested with real restores. Backups won't stop data from being stolen, but they are what lets you keep operating if your files are encrypted.
  • Watch for large outbound data transfers. 1.27 TB doesn't leave a network quietly. Monitoring and logging, which the rule also requires, give you a chance to catch it.

Lesson 5: If you prepare returns, your WISP is a legal requirement

This is the one many small firms still don't realize. Under the Gramm-Leach-Bliley Act, the IRS and FTC treat tax and accounting professionals as financial institutions, regardless of size. That means the FTC Safeguards Rule applies, and a core requirement is a Written Information Security Plan (WISP). The IRS and its Security Summit partners repeated that reminder again this year in IR-2026-92 (August 18, 2026).

According to IRS Publication 5708, the plan needs to, among other things:

  • Designate a qualified individual to coordinate your security program
  • Assess the risks to customer information and how well your current safeguards address them
  • Put safeguards in place, then regularly monitor and test them
  • Choose service providers that can protect customer data, and require it in their contracts
  • Require MFA for anyone accessing your information systems
  • Report a security event affecting 500 or more people to the FTC as soon as possible and no later than 30 days after discovery

The rule also calls for a written incident response plan, so you know who does what, and who calls whom, on the worst day. The good news: you don't have to start from a blank page. IRS Publication 5708 includes a sample WISP template written for smaller practices, and Publication 4557, Safeguarding Taxpayer Data, walks through the security basics. A WISP isn't a one-time document, though. The IRS expects it to be reviewed and updated as your firm changes.

The bottom line

We don't yet know what actually happened at INTAX, and the firm deserves the chance to tell its own story. But you don't need the final facts to learn from the claim. Look at your own file server and ask four questions: How many years of client records are on it that we don't need? Is there a password file anywhere on it? Is MFA on for every system that supports it? And do we have a current, written security plan that someone actually owns?

If any of those answers make you uneasy, that's normal, and it's fixable. Essential Solutions helps accounting firms and professional-services offices across the Baton Rouge area clean up retention, roll out password managers and MFA, separate and back up sensitive data, and put together a WISP that matches how your office really works. Reach out to us or call (225) 336-0273 for a practical review before next tax season.