Hackers are targeting taxpayers as they file - here's what to look for
Russia-linked actors are targeting tax firms in the US, stealing highly sensitive data
(Image credit: sarayut Thaneerat/ via Getty Images)
- Russia-linked Lynx gang claims ransomware attack on CSA Tax & Advisory, leaking taxpayer data
- Exposed records include SSNs, tax returns, health coverage agreements, and internal corporate correspondence
- Breach risks full identity theft, IRS fraud, insurance scams, and severe business/regulatory consequences
CSA Tax & Advisory, a local accounting and tax firm from Haverhill, Massachusetts, reportedly suffered a ransomware attack at the hands of a Russia-linked ransomware gang. The group, calling itself Lynx, added CSA to its data leak site recently, saying it also stole sensitive data from US taxpayers.
CSA is yet to confirm or deny the breach, so whether or not Lynx’s claims are legitimate, remains to be seen.
Still, the group shared a data sample on its site, and researchers from Cybernews claim it contains people’s full names, Social Security Numbers (SSN), postal addresses, spousal health care coverage agreements, invoices, individual income tax return data, IRS e-file signature authorization forms, and internal corporate correspondence.
How the data could be abused
If confirmed, the breach would be quite serious, since it would be full identity and financial compromise - putting victims at risk of identity theft and fraud.
At the individual level, SSNs combined with postal addresses and tax return data can result in complete identity theft. Criminals can open credit cards, take out loans, file fraudulent tax returns to claim refunds, and pass identity checks at banks, lenders, and government services. Because SSNs don’t expire, the damage can persist for years.
Tax-specific documents like IRS e-file signature authorization forms can also be abused to submit fraudulent tax filings, redirect refunds, or alter filings before the victim notices.
Victims can end up in months’ long disputes with the IRS to prove they were victims of fraud. Spousal health care coverage agreements can lead to insurance fraud and extortion. Attackers can use this information to submit fake insurance claims, impersonate policyholders with insurers, or threaten to expose sensitive family or medical-related details - so there is a serious and measurable danger for those exposed (if the breach occurred).
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Crooks can also use the data to target businesses with social engineering, business email compromise (BEC), or financial fraud.
Internal emails can reveal workflows, approval chains, and trust relationships, which cybercriminals can abuse to great extent. In such scenarios, businesses would be looking at regulatory penalties, mandatory breach notifications, lawsuits, loss of client trust, and potential professional liability claims. In the US, exposure of SSNs and tax data often triggers state breach laws, IRS scrutiny, and possible FTC action.
Via Cybernews
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.