October 21, 2026

Tax Firm Data Breach Response Plan: Who Calls Whom Before Filing Season

Tax firm data breach response plan call list on a desk beside an office phone

The first sign usually shows up in January. A client calls to ask why the IRS rejected a return the firm hasn’t filed yet. Another client gets a refund for a return they never signed. By then, the question is no longer whether the firm was breached. The question is who makes the next call, and whether anyone wrote that down. A tax firm data breach response plan answers that question before filing season, while there is still time to think.

Last Updated: October 2026

This guide is for owners, managing partners, and office managers at tax and accounting firms with no full-time security lead. It covers what federal guidance expects and who to notify, in what order. It also covers the warning signs that mean you are already in the plan, and how to turn the plan into routine work.

Key takeaways

In October 2026, the IRS restated that tax and accounting professionals must have a Written Information Security Plan by law. The response plan is the part of that WISP most firms leave thin.
Your first call after client data theft goes to your local IRS Stakeholder Liaison, not the IRS toll-free line. Speed lets the IRS block fraudulent returns.
Under the FTC Safeguards Rule, a breach exposing 500 or more consumers’ unencrypted data must be reported within 30 days.
A plan only works if it names a decision owner, a call list, and the records you keep. Write it in November, test it in December.

Why a tax firm data breach response plan has to exist before January

Tax data is unusually easy to turn into money. A name, Social Security number, and prior-year return are enough to file a fraudulent return and redirect the refund. That is why the IRS treats tax professionals as a primary target. It describes January through April as prime season for attacks on tax practices. Firms hold the most client data then and have the least time to notice anything unusual.

Meanwhile, the attacks themselves are getting harder to spot. The 2026 Security Summit series flagged IRS impersonation, “new client” schemes, and attacks aimed at EFINs, PTINs, and CAF numbers. IBM’s 2026 Cost of a Data Breach Report found that one in four malicious breaches were AI-enabled. That is a 56% increase over the prior year, driven mostly by deepfake impersonation and AI-enabled malware. As a result, a convincing fake client or a cloned partner email is now cheap to produce.

Email remains the expensive door. The FBI’s 2025 Internet Crime Report counted 24,768 business email compromise complaints with roughly $3.05 billion in reported losses. For example, a compromised preparer mailbox gives an attacker client documents, engagement letters, and a trusted address to send from.

None of this means a breach is inevitable. It means the hours after discovery decide the damage. Those hours go badly when nobody owns the decisions.

What federal guidance expects after a tax firm data breach

Two federal sources shape the expectation. Both deserve a careful read, because coverage depends on your firm’s activities, size, and state.

The FTC Safeguards Rule

The FTC Safeguards Rule applies to “financial institutions” under FTC jurisdiction, and the FTC lists tax preparation firms among its examples. Covered firms must keep a written information security program. One required element is a written incident response plan that covers:

The goals of the plan
The internal processes the firm activates during a security event
Clear roles, responsibilities, and decision-making authority
Communication inside and outside the firm
A process to fix weaknesses the event exposed
Documentation and reporting of the event and the response
A post-incident review and updates to the plan

Two details matter for smaller firms. First, firms that hold customer information on fewer than 5,000 consumers are exempt from certain provisions. The written incident response plan is one of them. Check 16 CFR 314.6 against your client count before assuming either way.

Second, that exemption does not remove the breach notification duty. Since May 2024, covered firms must notify the FTC as soon as possible after discovering a qualifying breach, and no later than 30 days. A breach qualifies when it involves the unencrypted information of at least 500 consumers.

The IRS WISP expectation

Separately, the IRS expects every tax professional to keep a WISP. IRS Publication 5708 walks through building one. The IRS recommends a data theft response plan as part of it, whether or not the FTC’s written plan requirement applies to you. The IRS can also treat a Safeguards Rule violation as a violation of its e-file provider rules. That puts your EFIN in play.

In addition, state law adds another layer. Most states have their own breach notification statutes, deadlines, and attorney general rules. They apply based on where affected clients live, so a firm that prepares returns in three states may answer to three sets of rules.

The first 24 hours: decisions, not heroics

The most common failure in a small firm is not a missing tool. It is ten people each assuming someone else is handling it. Your plan should settle these decisions in advance.

Name one decision owner

Pick one person, usually the managing partner or operations lead, to declare an incident and direct the response. Name a backup for when that person is on vacation in March. The FTC calls this “clear roles and levels of decision-making authority.” In practice it means one phone number everyone knows to call.

Contain without destroying evidence

First, disconnect affected machines from the network rather than wiping them. Next, reset passwords for compromised email and tax software accounts from a clean device. Then turn on multifactor authentication anywhere it is missing. Write down what you saw and when, because every later notice depends on that timeline.

Bring in help early

Call your IT provider or a forensic firm to find out how the attacker got in and what they touched. For the split between that work and your firm’s, see who owns what in a small business data breach response. Before you hire anyone, check your insurance policy. In many cases, policies name approved vendors and set response requirements. Finally, your plan should list these contacts with phone numbers, not just company names.

The call list: who to notify after a tax firm data breach

This is the section most WISPs leave as a single sentence. Write it as a list your office manager could follow at 7 a.m. without you.

Your local IRS Stakeholder Liaison. Report client data theft here first. The liaison alerts IRS Criminal Investigation and the right IRS offices for you. The IRS will need a list of affected taxpayers, including names and Social Security numbers. The IRS toll-free line cannot accept this report from a third party. Find your liaison on the IRS Stakeholder Liaison contacts page.
State tax agencies. Report through the Federation of Tax Administrators’ Report a Data Breach page for each state where you prepare returns.
Law enforcement. File a report with local police and, for email or wire fraud, with the FBI at ic3.gov.
Your tax software provider. They may need to reset credentials, watch for suspicious filings under your EFIN, or flag accounts.
State attorneys general. Most states require notice to the AG or another state office once a breach meets their threshold. Deadlines vary by state.
The FTC, if the 500-consumer threshold is met. Use the FTC’s online form within 30 days of discovery. Report what you know and update it later.
Affected clients. Tell them what happened and what to do. The IRS recommends steering clients toward an Identity Protection PIN or, when appropriate, Form 14039, the Identity Theft Affidavit. Some states require offering credit monitoring or identity protection.

Keep this list in your plan with names, phone numbers, and email addresses filled in. Then keep a paper copy, because a locked-up network is exactly when you cannot open the shared drive.

Warning signs you are already in the plan

In fact, many firms learn about a tax firm data breach from the IRS or a client, not from their own systems. The IRS and Security Summit partners point to signs like these:

Clients who have not filed receive refunds or IRS acknowledgments
More returns are filed under your EFIN than you have clients
Clients reply to emails your firm never sent
E-file acknowledgments arrive for returns you did not submit
Computers slow down, lock staff out, or show cursors moving on their own

Put this list in front of every preparer and admin before January. After all, the person most likely to spot the first sign is the one answering the phone, not the partner.

Turning the plan into an operating rhythm

A tax firm data breach response plan that sits in a folder does not help much. The firms that recover fastest treat it as recurring work with an owner and records.

Assess. Know what client data you hold, where it lives, and who can reach it. You cannot report “which clients were affected” if you do not know where returns are stored.

Train. Walk staff through the warning signs and the “new client” scheme before the season starts. Our six-week staff training plan for tax firms lays out how. Also make it clear who they call, and that reporting a mistake fast is never the wrong move.

Review vendors. Your tax software, cloud storage, IT provider, and client portal all touch client data. Confirm how each one would notify you of an incident and what they would need from you.

Rehearse. Run a 45-minute tabletop exercise in December. Read a scenario aloud, such as a client calling about a refund they never requested. Then walk through the call list. That way, every gap you find in December is one you do not find in February.

Document. Keep a record of training dates, vendor reviews, and the tabletop. When a client, carrier, or regulator asks what you did, those records are the answer.

Frequently asked questions

Do tax preparers have to report a data breach to the IRS?

The IRS asks tax professionals to report client data theft right away to their local IRS Stakeholder Liaison. That lets the IRS block fraudulent returns. The IRS toll-free line cannot take third-party reports of tax-related identity theft.

When does a tax firm have to notify the FTC of a data breach?

Firms covered by the FTC Safeguards Rule must notify the FTC within 30 days of discovering a qualifying breach. A breach qualifies when it involves the unencrypted information of at least 500 consumers. Whether the rule covers your firm depends on its activities.

Is a data theft response plan part of a WISP?

Yes. IRS Publication 5708 guides tax professionals through a Written Information Security Plan, and the IRS recommends a data theft response plan as part of it. The FTC Safeguards Rule separately requires a written incident response plan for covered firms. Firms holding data on fewer than 5,000 consumers are exempt from that piece.

What should happen in the first hour of a tax firm data breach?

The named decision owner declares an incident. The team disconnects affected devices without wiping them, secures compromised accounts from a clean device, and starts a written timeline. Then the owner calls your IT or forensic provider and your IRS Stakeholder Liaison.

What are the signs a tax firm has had a data breach?

Watch for clients receiving refunds or IRS notices for returns they did not file. Other signs include more returns under your EFIN than you have clients, clients replying to emails you never sent, and unexplained computer lockouts.

How often should a tax firm test its data breach plan?

At least once a year, ideally in November or December before filing season. A short tabletop exercise that walks through the call list will surface missing contacts and unclear roles.

Put owners and records behind your plan

Your firm already answers for client data. The work is making sure someone owns the response, staff know the warning signs, and vendors get reviewed. You also need to show what was done. defend-id helps tax and accounting firms organize, assign, and document that work. The platform includes 24/7 incident response and breach support, staff security training, vendor management, and vulnerability scanning. Your firm remains responsible for its own program and obligations. Want to see how your response plan would hold up this filing season? Talk with our team at defend-id.

Read the story behind the platform: why we rebuilt defend-id for small businesses.

Sources: IRS Tax Tip 2026-72; IRS Data Theft Information for Tax Professionals; FTC Safeguards Rule: What Your Business Needs to Know; IBM 2026 Cost of a Data Breach Report; FBI IC3 2025 Internet Crime Report. This article is general information, not legal advice. Requirements depend on your firm’s activities, size, and states of operation.