Data Breach Response for Tax Professionals
When a breach happens, every minute counts. Know exactly what to do with a plan built for tax professionals.
By the Numbers
What Tax Professional Data Breach Response Covers
Immediate Containment
Isolate affected systems, change credentials, and preserve evidence within the first hour.
IRS Notification (Form 14039)
File Identity Theft Affidavits and notify the IRS Stakeholder Liaison within required timeframes.
Client Notification
Communicate with affected clients using compliant notification templates and provide next steps.
Law Enforcement Reporting
File reports with the FBI IC3, local police, and state attorneys general as required by law.
Forensic Investigation
Conduct or commission a forensic analysis to determine the scope and cause of the breach.
Recovery & Hardening
Restore systems from clean backups and implement additional security measures to prevent recurrence.
How to Get Started
Detect & Contain
Identify the breach, isolate affected systems, and stop ongoing unauthorized access immediately.
Assess & Document
Determine what data was compromised, how many clients are affected, and preserve all evidence.
Notify & Report
Contact the IRS, affected clients, law enforcement, and state regulators per legal requirements.
Recover & Strengthen
Restore operations, implement lessons learned, and update your security plan.
Be Prepared Before a Breach Happens
Our WISP includes a complete incident response section. Get yours before tax season.
Frequently Asked Questions
Immediately isolate affected systems from your network, change all administrative passwords, and begin documenting everything. Do not turn off computers — preserve forensic evidence.
Contact your local IRS Stakeholder Liaison, report to the Treasury Inspector General (TIGTA), file Form 14039 for each affected taxpayer, and email the IRS at dataloss@irs.gov.
Yes, most states require individual notification to affected clients, typically within 30-60 days. You should provide them with credit monitoring and identity theft protection guidance.
Yes, if the IRS determines inadequate security measures led to the breach, your Electronic Filing Identification Number (EFIN) can be suspended or revoked.
Protect your tax practice from cyber threats
Schedule a free consultation to assess your firm's security posture.