Financial software (opens in new tab) maker Intuit has notified users of its TurboTax (opens in new tab) platform that some of their personal and financial information was accessed by attackers in what appears to be a series of account takeover attacks.
"By accessing your account, the unauthorized party may have obtained information contained in a prior year's tax return or your current tax return in progress, such as your name, Social Security number, address(es), date of birth, driver's license number and financial information (e.g., salary and deductions), and information of other individuals contained in the tax return," explained Intuit in the breach notification letter sent to customers.
The company added that it has taken “various measures” to help protect its tax software (opens in new tab) customer accounts, adding that investigations suggest that the attack was not a "systemic data breach of Intuit."
- Shield yourself with these best identity theft protection services (opens in new tab)
- These are the best endpoint protection tools (opens in new tab)
- And here are the best malware removal (opens in new tab) software on the market
Poor password hygiene
Intuit suggests that the accounts were compromised as part of an account takeover attack, where cybercriminals use users credentials gleaned from data breaches on other online services. These attacks are the result of users reusing the same login credentials on multiple online services.
The accounts breach came to light during a regular security review, leading to further investigations that revealed the attack had exposed various details about the customers.
As soon as the attack came to light, Intuit temporarily disabled the breached TurboTax accounts. Intuit has also provided a complimentary one year subscription to identity protection services (opens in new tab) to the affected customers.
Bleeping Computer (opens in new tab) further reports that TurboTax customers have been targeted in at least three other account takeover attacks in 2014/2015 (opens in new tab) and most recently in 2019 (opens in new tab).
- Protect your devices with these best antivirus software (opens in new tab)