Tax Season Ransomware: Why CPA Firms Get Hit Between February and April

An operator note for firm owners, partners, and the IT generalists who keep accounting firms running.

If you run or support a firm with two to fifty CPAs, EAs, or tax preparers, you are inside the target zone — and between February 1 and April 15 you are inside the highest-pressure window of your year. So are the operators.

Why tax season is the perfect storm

Ransomware operators are economically rational. The February-to-April window checks every box at once.

The deadline is immutable. April 15 does not move because a firm has been encrypted. October 15 does not move for extension filers. The penalty math runs against the taxpayer, the malpractice exposure runs against the firm.

The data is at maximum sensitivity right now. Off-season the tax software holds prior-year returns. During tax season it holds prior-year returns plus current-year work in progress — every W-2, K-1, SSN, EIN, and bank routing number for refund deposit and estimated payments.

The workforce is inflated and under-vetted. Most firms bring in seasonal preparers in late January. Credentials are provisioned fast, training is compressed. The seasonal hire who clicks the IRS-impersonation email on their second day is a classic entry point in February through April.

Hours are long and fatigue is high. Saturday hours, Sunday hours, late evenings. People click faster when tired. Operators time their lures to Friday and Sunday evenings deliberately.

Financial-impact pressure peaks. A week of downtime in October is bad. A week of downtime in late March can take the firm's annual revenue with it. Operators price the ransom against what the firm cannot afford to lose.

Client money moves on a predictable schedule. Refund deposits, estimated quarterly payments, and direct-debit installments all flow through the firm's workflow. Operators who have been in the environment know when those movements happen and use it in negotiation.

The operators actually doing this work

This is an ecosystem, not a single group.

The crews most active against accounting and tax-adjacent SMB targets over the last 18 months include:

• Akira
• Black Basta
• ALPHV/BlackCat (brand collapsed in early 2024 but affiliates moved laterally)
• Hunters International
• INC Ransom
• Play
• BianLian
• Royal (rebranded as BlackSuit)
• RansomHub
• Medusa.

The Sax LLP breach disclosure filed with the Maine Attorney General and the Wojeski & Company incident that produced a New York Attorney General settlement both sit inside this landscape.

Several operate as ransomware-as-a-service. The playbooks are consistent, which is good news for defenders. Double-extortion is the default — assume any successful intrusion includes data theft.

The attack chain inside a typical CPA firm

It usually starts with a phishing email, and during tax season it usually lands with a seasonal preparer or the billing person handling the inboxes that produce the most legitimate clicks.

The lures are tuned to the season:

• IRS notice impersonation — fake CP2000, fake CP504, fake EFIN suspension threat, fake e-file rejection.
• EFIN suspension — exploiting genuine anxiety about EFIN status among newer preparers.
• ADP / Gusto / Paychex payroll lookalikes — timed to actual pay cycles.
• Client portal lookalikes — fake notices that "a client has uploaded a document for your review."

The payload is a loader. Residual Qakbot variants still circulate; Pikabot dominated 2024; DarkGate and Latrodectus have been the most active loader families across 2024 and 2025.

The loader's job is to phone home, establish persistence, and let the operator inside.

Within hours, the operator harvests credentials. LSASS memory dumps are standard. Browser-saved passwords, cached Windows credentials, RDP histories, and the credential manager all get scraped.

Lateral movement targets the tax software server. Cobalt Strike is still the most common C2 beacon, with Sliver, Brute Ratel, and NetSupport RAT in heavy rotation.

The operator pivots to the Lacerte network instance, the Drake server, the CCH Axcess on-prem deployment, UltraTax, or ATX. They search for high-value file types — .tax, PDF copies of returns, Lacerte client data files, .qbb QuickBooks backups, .qbw working files, and the source-document tree.

Exfiltration follows, usually to Mega, an S3 bucket on a stolen card, or a rented VPS. Encryption is last, almost always Friday evening through Sunday. By Monday morning the tax software will not open and a ransom note is on every desktop.

Why the tax software server is the crown jewel

Lacerte, Drake, CCH Axcess, UltraTax, ATX, ProSeries — the product varies but the architecture does not.

The tax software runs a SQL-style backend containing client master data, prior-year returns, current-year work in progress, e-file submission status, refund deposit routing, and references to source documents.

Encrypt that backend and you have encrypted the firm. Preparers cannot open returns. Reviewers cannot sign off.

E-file submissions stop. Amended returns cannot be processed. With April 15 days away, the consequences compound by the hour — and the firm's bargaining position shrinks with every hour that passes.

The first hour

If you are reading this in the middle of an active incident:

Disconnect the network at the switch level. Not the WAN router — the switch in the comm closet. Pull every cable or power it off. Unplugging the internet still lets the encryptor finish on the LAN.

Isolate every workstation. Do not power them off. Memory forensics matters. Lock screens, pull network cables, leave machines running.

Call your cyber insurance carrier first. Before the IRS, before the FBI, before the MSP, before you read the ransom note. The policy almost certainly requires the carrier's panel firms. Engaging your own forensics firm first can invalidate coverage.

Do not delete the ransom note. It is evidence the negotiator will need.

Document everything in a paper notebook. Times, names, decisions, calls. The laptops are evidence.

Confirm offsite immutable backups exist and are unreachable from the compromised network. Do not connect to them yet. If the backups were on the same domain or used the same credentials, assume they are gone.

Notify the IRS Stakeholder Liaison promptly. IRS Publication 4557 directs tax professionals to report data theft as soon as it is suspected.

The Stakeholder Liaison process is covered in our writeup on IRS Publication 4557 and the FTC Safeguards Rule for CPA firms.

Do not pay, do not click links in the ransom note, do not negotiate. Breach counsel and the carrier's negotiator handle that.

The first week

The first week is structured by the cyber insurance carrier, the IRS Stakeholder Liaison process, the FTC Safeguards Rule, and state breach notification law, in roughly that order.

Forensic investigation. The carrier-appointed panel firm images systems, identifies the entry point, scopes exfiltration, and confirms whether the threat actor is still inside. Five to ten days for a small to mid-size firm.

Scope determination covers which clients, which tax years, which return types, and whether bank routing numbers or prior-year PDFs were in the exfiltrated set.

IRS Stakeholder Liaison. The Liaison coordinates with IRS Return Integrity and Compliance Services to flag affected taxpayer accounts against fraudulent return filing, and walks the firm through expedited PTIN and EFIN re-verification if either was compromised.

Pub 4557 Section 5 is the operational reference.

State authorities. Many states require parallel reporting when a preparer is breached, and most run a 30-to-60-day breach notification clock from discovery when SSNs, financial account numbers, or tax IDs were exfiltrated.

Breach counsel coordinates filings; affected-taxpayer letters require specific identification of data categories exposed, remediation steps, and credit monitoring offered.

The tax-deadline question. The IRS has discretionary authority under disaster-related procedures to grant filing and payment relief. In practice, the firm files a written hardship request through the Stakeholder Liaison, supported by forensic findings and breach counsel attestation.

Relief is not automatic, but case-by-case extensions have been granted for documented cyber incidents. File early, document thoroughly.

Recovery is realistically five to twenty-one days for a full tax software server restore with tested backups, and four to eight weeks without. Model what this downtime range costs your firm: the ransomware cost calculator.

The decision to pay — honest assessment

Paying does not guarantee data return. The decryptor may be partial, slow, or broken. Exfiltrated data may be published or sold regardless. Several operators and affiliates are sanctioned by OFAC, making payment a federal violation independent of operational pressure.

Cyber insurance carriers now require pre-approval, run OFAC screening, and exclude payments to sanctioned entities. The FBI's standing guidance remains do-not-pay. We align with that guidance.

Our response guidance starts with the available recovery options and the consequences of losing access during tax season. Some firms have paid; outcomes vary, and in several documented cases the exfiltrated data appeared on leak sites even after the ransom was paid.

The decision is made with breach counsel and the carrier on the call — not at 9 p.m. on a Saturday alone with a countdown timer.

The controls that actually break the chain

This is the section that matters. Everything above is what happens when nothing is in place. Here is what stops it.

Huntress Managed EDR on every endpoint AND on the tax software server. Most firms cover workstations and skip the server "because it's not a workstation." That is exactly the machine the operator is coming for.

The ransomware canary catches encryption behavior in sub-millisecond time, and the loader stage — Pikabot, DarkGate, Latrodectus, residual Qakbot — gets caught and investigated by the SOC before lateral movement begins.

See the Managed Detection and Response service page.

Managed ITDR on Microsoft 365 or Google Workspace. Catches:

• The BEC that delivers the loader
• The malicious inbox rule that hides attacker activity
• The account takeover that often precedes ransomware by weeks

It is common for firms to discover old mailbox compromise only after identity telemetry is finally being watched. See the Managed ITDR service page.

MFA on the tax software admin account. Lacerte, Drake, CCH Axcess, UltraTax, and ATX all support it. Most firms do not enable it because "it slows me down during tax season" — exactly the argument the operator counts on. App-based or hardware token, not SMS.

Immutable offsite backups following the 3-2-1-1-0 rule. Three copies, two media types, one offsite, one immutable, zero errors on the last verified restore. Tested quarterly. Test before February, not during.

Network segmentation between the front office and the tax software server. Guest wifi and the staff workstation network should not share a VLAN with the tax software server.

Security awareness training with tax-season-specific phishing simulations. Generic annual training is checked once and forgotten.

Training tuned to IRS-impersonation themes, EFIN suspension lures, ADP and Gusto lookalikes, and e-file rejection notices materially reduces the click rate on the lures that actually land in February through April.

Seasonal-contractor credential lifecycle. Provisioned in late January with documented permissions. Deprovisioned April 16 — or October 16 for extension preparers — no exceptions. The dormant seasonal account still active in July is the account the operator finds in September.

A documented incident response plan and a cyber insurance policy you have actually read. Both on the cyber insurance readiness page.

The MSP supply-chain risk

Most small accounting firms use a generalist MSP that holds tax software admin credentials, domain admin rights, and backup system access shared across multiple firm clients, and accesses the firm's network through a remote management platform — ConnectWise ScreenConnect, N-able, Datto RMM, Kaseya, Atera — which is itself a high-value target.

If the MSP is compromised, every accounting firm they service is in scope simultaneously. This pattern has been documented in publicly disclosed mass-impact advisories across 2024 and 2025.

This is not an indictment of every MSP. It is structural. Your MSP's security posture is functionally your firm's security posture.

Ask whether they have:

• MFA on their RMM
• EDR on every technician laptop
• A credential vault that is not a spreadsheet
• Per-client credentials for privileged access

The security layer needs to be operated independently of the IT layer — the model we run on the accounting industry page.

What to do this week if you are not in an active incident

Three things, in this order.

Read your cyber insurance policy end to end, especially the required-controls section and the incident response panel. If your controls do not match the policy, fix that gap before you need to file. A denied claim in late March is worse than no policy at all.

Audit administrative access to your tax software, Microsoft 365 or Google Workspace tenant, backup system, and domain. Remove anyone who should not be there — start with last year's seasonal credentials.

Confirm phishing-resistant MFA on everyone who remains. Include your MSP — the shared credentials are usually where the surprise lives.

Schedule a backup restore test of the tax software database to a non-production environment, witnessed by a partner, with written confirmation that the database opened cleanly and a sample return was retrievable. If your provider cannot or will not perform that test, you have your answer.

If you want an operator's read on where your firm stands, that is what we do.

Start at the accounting industry page or the cyber insurance readiness page. Talk with us about your firm's security questions.

Attackers do not need your firm to be unprepared. They need it to be more unprepared than the one across town. Closing that gap is achievable, and the controls that close it are not exotic — they are operational discipline applied consistently, before February rolls around again.