Data Breach Checklist for Tax Preparers

If you suspect a data theft: disconnect the affected computer from the network, call your cyber insurance carrier if you have one, and report it to your IRS Stakeholder Liaison right away. Speed matters, because the IRS can block fraudulent returns filed in your clients' names once it knows.

Warning signs

The IRS lists these signs that a tax office may have been breached:

Client returns are rejected because a return was already filed with that Social Security number.
You receive more e-file acknowledgments than returns you filed.
Clients receive IRS identity-verification letters for returns they didn't file, or get transcripts or refunds they didn't request.
Clients reply to emails you never sent.
Computers run slowly, the cursor moves or numbers change on their own, or you are locked out.
The IRS disables your online account, or tells you your CAF number has been compromised.
Transcripts you didn't order appear in your e-Services account.
The IRS contacts you about a client you don't represent.

In the first hour

Disconnect, don't destroy. Unplug the network cable or turn off Wi-Fi on the affected device. Don't wipe it, reinstall it or throw it away. It may hold evidence.
Start a log. Write down what you noticed, when, and everything you do from here on. Photograph the screen with your phone.
Use the phone. If email may be compromised, talk about the incident by phone or in person.
Call your insurance carrier before hiring anyone. Many policies require you to use their approved responders.

The same day

Report to the IRS through your local Stakeholder Liaison. The regular IRS phone lines don't take these reports. Search “stakeholder liaison local contacts” on IRS.gov.
Change passwords from a clean device, starting with email and tax software. Confirm a second login step is on, and check your email for forwarding rules you didn't create.
Protect your backups. Disconnect them so they can't be encrypted or deleted.
Bring in a security professional to find the cause and how far it went.

In the first few days

Report to state tax agencies for each state where you prepare returns. The Federation of Tax Administrators keeps a “Report a Data Breach” page with state contacts.
Contact law enforcement. File a report with local police. Contact the FBI for criminal intrusions and for any ransomware attack.
Notify affected clients. Your state's breach law sets the deadline and what the notice must say. In Ohio, notice is due no later than 45 days after discovery. Suggest clients get an IRS Identity Protection PIN.

Within 30 days

Notify the FTC if unencrypted information on 500 or more people was taken. The FTC has an online form, and the deadline is 30 days from discovery.

Afterward

Watch closely for a month: e-file acknowledgments, your IRS accounts and your email rules.
Write down what happened and what you'll change, and update your written security plan to match.

Before anything happens

Every step above is easier if the phone numbers are already written down. Your written security plan should hold this list, filled in with your own IT contact, insurance claims line and Stakeholder Liaison. That's a standard part of every TaxFort plan.

Sources

This page is general information, not legal advice.

Data breach checklist for tax preparers