Small Accounting Firms Face the Same Cyber Rules as Large Ones

Small tax and accounting practices can be attractive to criminals because they combine valuable records with limited security resources. Automated systems routinely probe online accounts, remote connections and outdated software for easy entry points. Verizon’s 2025 report linked ransomware to 88% of breaches among small and midsized organizations, versus 39% among larger ones.

Even a compact practice may store Social Security and employer identification numbers, tax returns, wage forms and banking information for many clients. Criminals can exploit those records for identity theft, bogus tax submissions or diverted refunds. They may also steal EFINs and PTINs to make fraudulent filings look connected to a real preparer. Clients can then encounter compromised accounts, refund delays and prolonged monitoring of their identities.

Federal requirements apply regardless of firm size. Under the FTC Safeguards Rule, tax and accounting practices must maintain a written security program, designate someone to manage it, use multifactor authentication for access to customer records and encrypt those records. A firm discovering a breach that affects unencrypted data belonging to 500 or more consumers must alert the FTC within 30 days. Clear procedures for secure document exchange, verifying unusual messages and responding to incidents can also help firms protect client relationships.