An employee at an accounting firm receives an email that appears to come from the IRS, a tax software provider, or an existing client. It asks them to review an urgent document or sign in to resolve an account issue.
They click the link and enter their credentials. Nothing unusual seems to happen, but the attacker now has access to the employee’s email account.
From there, the attacker can reach tax returns, Social Security numbers, financial statements, payroll records, and confidential client communications. The account can also be used to impersonate the firm, redirect payments, or harvest additional credentials.
This is not a specific client case. It illustrates how accounting firm breaches commonly begin.
Why Accounting Firms Are Attractive Targets
Accounting firms hold concentrated amounts of sensitive financial and identity information. One compromised account can expose information belonging to hundreds of individuals and businesses at once.
Tax and accounting firms are also required to maintain a Written Information Security Plan, known as a WISP. But having the document does not mean the firm is actually protected. What I see repeatedly across cybersecurity programs is the difference between what’s written down, what’s been purchased, and what’s actually configured, monitored, and tested day to day.
Where the Weaknesses Often Appear
Common issues include:
- Multifactor authentication that isn’t enforced across every critical account
- Client documents exchanged through ordinary email
- Excessive access to sensitive information
- Limited monitoring of Microsoft 365 or Google Workspace
- Security policies that are never actually tested
- Backups that have never been tested through a full recovery
- No clear incident-response process
Making the WISP Real
A WISP nobody has opened since the day it was signed isn’t protecting anyone. Before recommending a single tool, the real question is what’s actually happening inside the firm: where client information lives, who can reach it, and whether the safeguards already in place are doing what everyone assumes they’re doing.
From there, the priorities usually sort themselves out. Identity gets locked down first, since a stolen password is still the fastest way in. Email gets secured next, since that’s how the attacker got in. Recovery gets tested, not just backed up. And the WISP itself gets rewritten to describe the environment as it actually exists today, not the one it was written for three years ago.
The goal isn’t a longer list of purchased tools. It’s a firm that can actually show, point by point, that its controls are implemented and working, not just documented.
Does your accounting firm’s security plan work in practice, or does it only exist on paper?
