Tax Preparer Data Breach: Records and Questions for Clients
Verify the notice, find out which records may be affected, and protect your tax filing and financial accounts.
If your tax preparer says it had a data breach, call the firm using a number from your prior paperwork or another trusted source. Ask which of your records and tax years were affected, whether anyone else on your return was included, and when you’ll get a written update.
Exposure and misuse are different. A breach notice tells you information may have been exposed. It doesn’t establish that someone filed a return in your name. You can take protective steps while the firm investigates.
Confirm the sender
Reach the firm through contact information you already trust.
Get the scope in writing
Ask about tax years, affected people, and specific types of data.
Keep filing on track
Confirm whether the return was submitted, accepted, or still needs action.
1. Verify the breach notice independently
Save the notice. Then contact the firm without using a link, QR code, or phone number from the message you’re checking. Ask for the person handling client questions and confirm how the firm sends updates. If the notice offers credit monitoring, verify the provider and enrollment route with the firm before entering personal information.
Keep IRS passwords, sign-in codes, and recovery codes private. If you need to send documents, ask which secure channel the firm currently recommends.
2. Ask questions about your own records
| Ask the firm | Why it matters |
|---|---|
| Which returns, source documents, and tax years are in scope? | A breach can involve prior-year files, identity documents, or portal uploads as well as the current return. |
| Which fields and people were affected? | Ask about full SSNs or ITINs, birth dates, bank details, and portal credentials. Include spouses and dependents. |
| What is confirmed, and what is still under review? | Ask whether the firm confirmed access or copying, or whether it only knows a system was exposed. |
| When did it happen, and when will I hear more? | Record the known dates, case contact, and next expected update. |
| What help is available, and how do I verify it? | Ask about enrollment deadlines, coverage length, and any help for other affected people on the return. |
If the answer is “we don’t know yet,” ask what the firm can confirm now. Write down what is still open and who will follow up.
3. Keep a private record of the incident
- Save the original notice, envelope if mailed, and written updates.
- Log each call with the date, contact name, case number, and next step.
- List the affected tax years and types of data without copying full SSNs or account numbers into the log.
- Keep your filed return, federal and state e-file acknowledgments, and any relevant IRS notices or rejection messages.
- Save confirmations for protective steps, such as a credit freeze or a bank fraud report.
Find out who was named in the records
The firm says its prior-year archive was affected. Your joint return included your spouse and a dependent. Ask which fields were in scope for each person. If the firm can confirm that the return was involved but hasn’t determined whether anyone copied it, record both facts and review protection options now.
4. Match your protective steps to what was exposed
- SSNs or other identity details: Review the FTC’s data breach guidance. Check your credit reports and consider a free credit freeze with each of the three credit bureaus. For a child, review the FTC’s separate guidance.
- Tax filing identifiers: Consider an IRS Identity Protection PIN (IP PIN). It helps protect federal tax filing. A credit freeze serves a separate purpose. Parents and legal guardians can review the IRS process for dependents.
- Bank details: Call your bank using a verified number. Ask what to monitor and whether you should take additional steps to protect the account.
- Portal credentials: Change exposed passwords through the verified service and anywhere you reused them. Enable multifactor authentication where available.
5. Confirm the status of any return in progress
Ask for the submission date and acceptance or rejection result for each return. Federal and state filings have separate acknowledgments. If a return hasn’t been filed, confirm who will file it, how you’ll review the final copy, and what filing and payment deadlines still apply.
If you get an IRS notice about a return you didn’t file or an e-file rejection that says your SSN was already used, follow the IRS identity theft guide. Use the instructions on a verified notice when applicable. Review the current Form 14039 instructions before filing an affidavit; a breach notice alone does not automatically require one.
Frequently asked questions
Does credit monitoring replace a credit freeze?
No. Monitoring can alert you to certain activity. A freeze restricts access to your credit report for new credit. Neither replaces an IRS IP PIN.
Should I file again if the firm can’t immediately confirm acceptance?
First establish whether the original return was accepted, rejected, or never submitted. Ask for the acknowledgment before deciding whether another submission is needed.
Does the preparer’s incident report fix a problem on my IRS account?
The firm’s breach report and your tax account are separate. If the IRS asks you to verify a return or respond to a notice, follow the verified instructions for your case.
Get the facts in writing and keep your next deadline in view
Find out whose information was affected, take steps for the specific data exposed, and keep a record you can refer to if questions come up later.
