Managed IT ServicesAccountants are a prime target for hackers. Your firm holds Social Security numbers, bank accounts, payroll records, and tax returns for dozens or hundreds of clients, which is exactly the kind of data criminals can turn into cash. Strong accounting firm cybersecurity is no longer optional. It’s a legal requirement, a client expectation, and a condition of most cyber insurance policies.
Large firms aren’t immune. In the well-known Deloitte breach, attackers got in through a single administrator account that reportedly wasn’t protected by two-step verification. That one password gave them access to sensitive information from major corporate and government clients. Basic multi-factor authentication could have stopped it.
Smaller firms face the same threats with fewer resources. In this guide, we explain why accounting firms are targeted, what the law requires, and seven accounting firm cybersecurity best practices eMDTec uses to protect CPA and tax practices across New Jersey.
Why Accounting Firms Are a Target for Hackers
The financial sector has been one of the most attacked industries for years, and accounting firms sit right in the middle of it. Here’s why criminals keep coming back.
Financial gain
Verizon’s Data Breach Investigations Report has found year after year that the overwhelming majority of breaches are financially motivated. Accounting firms handle large amounts of money and the data needed to steal more of it, including information that can be used to file fraudulent tax returns or redirect refunds.
High-value clients
Accountants often hold detailed financial information on business owners, executives, and high-net-worth individuals. That data can be used for extortion, identity theft, or targeted wire fraud against your clients.
Ease of access
Attackers know many small and mid-sized firms don’t have the security of a large enterprise. One review of breach disclosures reported by the Journal of Accountancy found 132 accounting firm breaches disclosed in a single state, and about 90% involved smaller firms. Weak accounting firm cybersecurity makes a small practice the easiest door into hundreds of clients’ finances.
Seasonal pressure and internal errors
Tax season brings long hours, temporary staff, and a flood of documents arriving by email. That’s the perfect environment for phishing. A tired employee clicking a fake “client document” link during March is one of the most common ways firms get compromised.
Accounting Firm Cybersecurity Threats to Watch in 2026
The attacks hitting accounting practices today are more convincing than the misspelled phishing emails of a few years ago. These are the threats we see most often.
Business email compromise and wire fraud
An attacker takes over a staff member’s or client’s mailbox, watches the conversation for weeks, then sends perfectly timed instructions to change where a refund, payroll deposit, or payment goes. Because the email comes from a real account, it looks legitimate. Verifying any banking change by phone, using a number you already have on file, stops most of these schemes.
Ransomware
Ransomware groups know accounting firms can’t afford downtime in March and April, so they time attacks for maximum pressure. Many now steal data before encrypting it and threaten to publish client records if you don’t pay. Isolated backups and endpoint detection and response are the core accounting firm cybersecurity defenses here.
AI-generated phishing and voice cloning
Generative AI lets criminals write flawless emails that mimic a client’s tone, and voice-cloning tools can imitate a partner on the phone. Training staff to slow down and verify unusual requests matters more than ever.
Compromised client portals and cloud accounts
Attackers reuse passwords leaked from other websites to log in to client portals, Microsoft 365, and cloud storage. Without MFA, a reused password is all they need.
Fake tax-season lures
Every year brings fake IRS notices, fake e-file alerts, and “new client” emails with malicious attachments. Attackers count on busy staff opening documents without a second look.
What the Law Requires: FTC Safeguards Rule and IRS Rules for Accountants
Accounting firm cybersecurity isn’t just good practice. For many firms, it’s federal law.
The FTC Safeguards Rule
Under the Gramm-Leach-Bliley Act, the FTC treats tax preparers and many accounting firms as “financial institutions.” The FTC Safeguards Rule requires covered firms to:
- Designate a Qualified Individual to oversee the security program.
- Complete a written risk assessment.
- Use multi-factor authentication for anyone accessing customer information.
- Encrypt customer information in transit and at rest.
- Train staff and monitor service providers.
- Maintain a written incident response plan.
- Report breaches affecting 500 or more consumers to the FTC within 30 days.
Our FTC Safeguards Rule compliance page includes a free 10-step checklist.
The IRS WISP requirement for tax professionals
The IRS requires paid tax preparers to have a written information security plan (WISP), and preparers attest to having a data security plan when they renew their PTIN. IRS Publication 4557 explains how to safeguard taxpayer data, and Publication 5708 provides a sample WISP template. Our guide to the written information security plan explains what yours should include.
7 Accounting Firm Cybersecurity Best Practices
These seven steps cover the controls regulators, insurers, and attackers care about most. Together, they form the core of a practical accounting firm cybersecurity program.
None of them require you to become a security expert. They do require consistency. The firms we see breached usually had good intentions and a few of these controls in place, but left one gap open, such as MFA on email but not on the tax software, or backups that hadn’t been tested in a year. Treat this list as a whole, and revisit it every year as your staff, software, and clients change. Accounting firm cybersecurity is a habit, not a one-time purchase.
1. Train your employees
People are both your biggest risk and your best defense. Train staff to spot phishing emails, fake client portals, and urgent requests to change banking details. Run short refreshers before tax season and simulated phishing tests throughout the year. Our guide on how to spot a scam email is a good handout for your team.
2. Require strong passwords and multi-factor authentication
Attackers use stolen and guessed passwords constantly. Require long passphrases, a password manager, and MFA on email, remote access, tax software, client portals, and cloud storage. Authenticator apps or hardware keys are stronger than text-message codes. If you’re comparing options, see our breakdown of the best MFA solution for SMBs.
3. Limit access to sensitive data
Give each employee access only to the clients and folders they need. Remove access immediately when someone leaves, including seasonal staff. Take local administrator rights away from everyday users so malware can’t install itself as easily. Least-privilege access is one of the most cost-effective accounting firm cybersecurity controls available.
4. Put a written data security policy in place
Document how client data is collected, stored, shared, retained, and destroyed. Include acceptable-use rules, remote-work requirements, and consequences for violations. This policy becomes part of your WISP and shows regulators you take accounting firm cybersecurity seriously.
5. Keep systems patched and protected
Attackers constantly exploit known vulnerabilities in Windows, browsers, PDF readers, and tax software. Apply security updates promptly, retire unsupported systems, and run managed endpoint detection and response on every computer.
6. Encrypt and share files securely
Never email tax returns or financial statements as plain attachments. Use a secure client portal or encrypted email, encrypt every laptop, and make sure backups are encrypted too.
7. Back up data and plan for incidents
Keep encrypted, isolated backups that ransomware can’t reach, and test restoring them before tax season. Write down who to call and what to do if you suspect a breach, including notifying the IRS Stakeholder Liaison, your insurer, and, in New Jersey, the New Jersey State Police before notifying affected clients.
Basic vs. Strong Accounting Firm Cybersecurity
Many firms have some protections in place but not enough to satisfy the Safeguards Rule or a cyber insurer. This comparison shows where the bar sits today.
| Area | Basic (common, but not enough) | Strong accounting firm cybersecurity |
|---|---|---|
| Login security | Passwords only, or MFA on email only | MFA on every system with client data, using an authenticator app or security key |
| Endpoint protection | Consumer antivirus | Managed endpoint detection and response with 24/7 monitoring |
| Backups | External drive or a single cloud sync | Encrypted, isolated backups with regular restore tests |
| File sharing | Email attachments | Secure client portal and encrypted email |
| User access | Everyone sees every client folder; users are local admins | Least-privilege access and same-day offboarding |
| Training | Occasional reminders | Annual training plus simulated phishing tests |
| Documentation | Downloaded template, never updated | Customized WISP reviewed every year |
If most of your answers fall in the middle column, you’re not alone. The good news is that moving to strong accounting firm cybersecurity doesn’t require a big upfront investment. Most of these controls can be rolled out in a few weeks and managed for a predictable monthly fee.
Start with the rows that carry the most risk for your firm. For most practices, that means MFA, backups, and secure file sharing. Then work down the list before your next renewal or tax season, whichever comes first.
Tax Season Accounting Firm Cybersecurity Checklist
Tax season is when attacks peak. Run through this short list every January:
- Confirm MFA is turned on for every user and every system holding client data.
- Remove accounts for staff who left since last season and set up seasonal staff with limited access.
- Verify backups are running and test a restore.
- Apply all pending updates to computers and tax software.
- Remind staff to verify any request to change direct-deposit or wire instructions by phone, using a known number.
- Review your WISP and update it for any new systems or vendors.
- Check that your client portal, not email, is the default way clients send documents.
Common Accounting Firm Cybersecurity Mistakes
- Emailing client documents unencrypted. It’s convenient, and it’s one of the easiest ways to expose data.
- Shared logins for tax software. They make it impossible to know who did what and violate the spirit of the Safeguards Rule.
- Relying on text-message codes alone. SMS-based MFA beats nothing, but phishing kits now intercept it.
- No offboarding process. Former seasonal staff with working credentials are an open door.
- Treating the WISP as a one-time download. An outdated plan won’t hold up if something goes wrong.
- Assuming cloud software is secure by default. The vendor secures its platform. Your firm still controls who logs in and how.
What to Do If Your Accounting Firm Is Breached
Even with strong accounting firm cybersecurity, you need a plan for the worst day. If you suspect a breach, act quickly and in this order:
- Contain it. Disconnect affected computers from the network, but don’t wipe or turn them off. Evidence matters.
- Call your IT provider and your cyber insurance carrier. Most policies require prompt notice and may require you to use their approved incident response firm.
- Change compromised passwords from a clean device and confirm MFA is enabled on every affected account.
- Notify the IRS. Tax professionals should contact their IRS Stakeholder Liaison so the IRS can watch for fraudulent returns filed with stolen client data. State tax agencies should be notified as well.
- Meet your legal notification duties. In New Jersey, businesses must notify the New Jersey State Police before notifying affected clients. If 500 or more consumers are affected, the FTC Safeguards Rule requires notice to the FTC within 30 days.
- Communicate with clients clearly and honestly, with guidance on next steps such as identity protection PINs and credit monitoring.
- Review and improve. Update your WISP and fix the gap that let the attacker in.
Our guide on what to do after a cyberattack covers the first 24 hours in more detail.
Building an Accounting Firm Cybersecurity Program Without a Full-Time IT Department
Most CPA firms don’t have, and don’t need, an in-house security team. A practical accounting firm cybersecurity program usually looks like this:
- A partner or firm administrator acts as the Qualified Individual, approves policies, and receives regular reports.
- A managed IT and security provider handles the technical safeguards: MFA, endpoint protection, patching, backups, monitoring, and incident response.
- Every employee completes training and follows the written security policy.
- An annual review updates the risk assessment, WISP, and insurance answers together.
This model gives small firms enterprise-grade protection for a predictable monthly cost, and it gives regulators and insurers clear proof that someone is accountable.
How Accounting Firm Cybersecurity Affects Cyber Insurance
Cyber insurance carriers have tightened their requirements. Applications now routinely ask whether you use MFA everywhere, whether backups are isolated from your network, whether you run endpoint detection and response, and whether staff receive security training.
Answering “yes” when the control isn’t fully in place can put a claim at risk. Strong accounting firm cybersecurity does double duty: it reduces the chance of an incident and keeps your coverage valid if one happens. We help firms answer renewal questionnaires accurately and close gaps before the renewal date.
Frequently Asked Questions
Are small accounting firms really at risk?
Yes. Smaller firms are often targeted precisely because attackers expect weaker defenses. A single compromised email account at a small practice can expose every client’s tax data.
Is accounting firm cybersecurity required by law?
For most tax and accounting practices, yes. The FTC Safeguards Rule requires a written information security program with specific safeguards, and the IRS requires paid preparers to have a written data security plan.
How much does accounting firm cybersecurity cost?
It depends on the number of users and systems. For most small firms, managed security services cost far less than a single breach, which can include forensic investigation, client notification, credit monitoring, and lost billable time.
Do we need a WISP if we use cloud-based tax software?
Yes. Cloud software moves where data lives, but your firm still controls who logs in, which devices connect, and how files are shared. Your WISP should cover all of it.
How often should we review our accounting firm cybersecurity?
Review your risk assessment and WISP at least once a year, ideally in the fall before tax season, and after any major change such as new software, a new office, or a security incident.
Can seasonal staff use their own laptops?
We don’t recommend it. Personal devices are hard to secure and impossible to wipe when the season ends. Provide firm-managed laptops or a secure virtual desktop so client data never lands on a personal machine.
What should we do first?
Turn on MFA everywhere, confirm your backups work, and get a risk assessment. Those three steps address the most common ways firms are breached.
Why Your Firm Should Partner with a Cybersecurity Provider Like eMDTec
Accounting firm cybersecurity takes ongoing attention, and most firms would rather spend that time serving clients. eMDTec has supported New Jersey businesses since 2002, and we understand the pressures of tax season, client portals, and FTC Safeguards compliance.
Our IT support for accounting firms includes MFA rollout, endpoint protection, 24/7 monitoring, secure backups, staff training, and WISP development. For firms that need broader protection, our cybersecurity services add managed detection and response around the clock.
Want to know where your firm stands before next tax season? Schedule a free consultation and we’ll review your accounting firm cybersecurity with you.