Cybersecurity for Accounting & CPA Firms

CPA firms are targeted by financially motivated criminals who want either client tax data, to file fraudulent returns, or money, through fake payment instructions. The patterns are consistent:

New client scams. The IRS and its Security Summit partners warned tax professionals again in August 2026 about emails from people posing as prospective clients whose attachments or links install malware and steal client information.

Business email compromise. The FBI's 2025 IC3 report logged 24,768 BEC complaints with about 3.05 billion dollars in reported losses, and California led every state in overall complaints and losses across all crime types.

Credential theft. Stolen email, portal, or tax software logins give criminals access to client records, and IRS Publication 4557 urges preparers to report data theft immediately so fraudulent returns aren't filed in clients' names.

Ransomware, which does the most damage when it lands close to a filing deadline and every hour offline costs returns.

The Safeguards Rule requires a written, risk-based security program, and several specific controls apply to every covered firm regardless of size:

A Qualified Individual who oversees the program (an employee or an outside provider).

Multi-factor authentication for anyone accessing any information system, and encryption of customer information in transit and at rest.

Security awareness training, oversight of service providers, and secure disposal of customer information no later than two years after it was last used, unless there is a legitimate business or legal reason to keep it.

Notice to the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers, a requirement in effect since May 13, 2024.

Firms that hold information on fewer than 5,000 consumers are exempt from four provisions: the written risk assessment, annual penetration testing with vulnerability scans every six months (or continuous monitoring), the written incident response plan, and the annual report to leadership. Everything else still applies.

California adds its own layer. The CCPA exempts personal information collected under the Gramm-Leach-Bliley Act, but not the private right of action for data breaches, and Civil Code 1798.82 requires notifying affected residents and sending the Attorney General a sample notice when more than 500 Californians are affected.

The controls that matter most for an accounting firm are the ones that stop a stolen password, a malicious attachment, or a ransomware infection from turning into a data breach. HD Tech's security-only SecurITy Lifeline package covers the core, including 24/7 SOC access; The Watch Tower adds help desk, dark web monitoring, and immutable backup:

Email security that filters malicious attachments and impersonation attempts before they reach preparers.

Managed detection and response on every laptop and server, watched 24/7.

Dark web monitoring for leaked staff credentials, plus vulnerability scanning to find unpatched systems.

Immutable backup that ransomware cannot encrypt or delete.

Ongoing security awareness training with phishing simulations built around tax-season lures.

Our cybersecurity work is led by Paul Morton, CISSP. Whoever runs your controls, your WISP should describe what is actually in place, not a downloaded template.