Hackers are targeting taxpayers as they file - here's what to look for

• Russia-linked Lynx gang claims ransomware attack on CSA Tax & Advisory, leaking taxpayer data
• Exposed records include SSNs, tax returns, health coverage agreements, and internal corporate correspondence
• Breach risks full identity theft, IRS fraud, insurance scams, and severe business/regulatory consequences

CSA Tax & Advisory, a local accounting and tax firm from Haverhill, Massachusetts, reportedly suffered a ransomware attack at the hands of a Russia-linked ransomware gang. The group, calling itself Lynx, added CSA to its data leak site recently, saying it also stole sensitive data from US taxpayers.

CSA is yet to confirm or deny the breach, so whether or not Lynx’s claims are legitimate, remains to be seen.

Still, the group shared a data sample on its site, and researchers from Cybernews claim it contains people’s full names, Social Security Numbers (SSN), postal addresses, spousal health care coverage agreements, invoices, individual income tax return data, IRS e-file signature authorization forms, and internal corporate correspondence.

How the data could be abused

If confirmed, the breach would be quite serious, since it would be full identity and financial compromise - putting victims at risk of identity theft and fraud.

At the individual level, SSNs combined with postal addresses and tax return data can result in complete identity theft. Criminals can open credit cards, take out loans, file fraudulent tax returns to claim refunds, and pass identity checks at banks, lenders, and government services. Because SSNs don’t expire, the damage can persist for years.

Tax-specific documents like IRS e-file signature authorization forms can also be abused to submit fraudulent tax filings, redirect refunds, or alter filings before the victim notices.

Victims can end up in months’ long disputes with the IRS to prove they were victims of fraud. Spousal health care coverage agreements can lead to insurance fraud and extortion. Attackers can use this information to submit fake insurance claims, impersonate policyholders with insurers, or threaten to expose sensitive family or medical-related details - so there is a serious and measurable danger for those exposed (if the breach occurred).

Crooks can also use the data to target businesses with social engineering, business email compromise (BEC), or financial fraud.

Internal emails can reveal workflows, approval chains, and trust relationships, which cybercriminals can abuse to great extent. In such scenarios, businesses would be looking at regulatory penalties, mandatory breach notifications, lawsuits, loss of client trust, and potential professional liability claims. In the US, exposure of SSNs and tax data often triggers state breach laws, IRS scrutiny, and possible FTC action.

Via Cybernews

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.