Cybersecurity Incident at the CPA Firm: The First 72 Hours, Hour by Hour

Most firms have a list of who to call after a breach. Fewer have an order of operations for the first three days, when people are tired, clients are calling and a busy-season deadline is still on the calendar. This guide is a timeline. It assumes the firm already has a written plan and contact list, as covered in the data theft response plan guide, and focuses on sequencing.

The times are a working template, not a legal standard. Statutory clocks are noted where a primary source sets one.

Hour 0: Who declares the incident?

An incident starts when someone reports something odd: a client asking about a return they did not file, an e-file rejection because a return was already filed, a strange mailbox rule, a ransom note. The person who receives the report should log it immediately with the time, the reporter and what was observed.

That log time matters. Under the FTC Safeguards Rule, a notification event is treated as discovered on the first day it is known to any employee, officer or agent of the firm (16 CFR 314.4(j)(2)). The firm's internal clock should start there too.

The incident lead (often the Qualified Individual named in the WISP) then decides whether to activate the response plan. When in doubt, activate.

Hours 0 to 4: Contain without destroying evidence

The FTC's breach response guide gives two instructions that pull in different directions, and both matter:

• Take affected equipment offline to stop further loss.
• Do not turn machines off until forensic experts arrive, and do not destroy forensic evidence while remediating.

In practice for a small firm:

1. Disconnect affected workstations from the network (unplug the cable, disable Wi-Fi). Leave them powered on.
2. Reset passwords for compromised accounts and revoke active sessions, but export the mailbox rules, sign-in logs and audit logs first.
3. Disable any remote access that may be the entry point.
4. Check e-file and payment workflows. If a credential tied to e-file or bank transfers may be exposed, pause those transactions.
5. Write down every action and its time.

Do not wipe and reimage anything yet. Do not delete phishing emails; quarantine them.

Hours 2 to 8: Call the insurer and counsel

Call the cyber insurer early, before engaging outside forensic or legal firms if possible. Many policies require prompt notice and some require using approved vendors for costs to be covered. The IRS also tells tax professionals to report the breach to their insurer and check whether the policy covers mitigation. Read the policy's notice condition and vendor terms now, not after the incident; the cybersecurity program guide covers the preparation side.

Counsel helps decide which laws apply and how to structure the investigation. Ask counsel whether the forensic engagement should run through them.

Hours 4 to 24: Report to the IRS and law enforcement

The IRS asks tax professionals to report client data theft to their local IRS Stakeholder Liaison. The IRS explains that the liaison notifies IRS Criminal Investigation and others within the agency on the firm's behalf, and that IRS toll-free assisters cannot accept third-party reports of tax-related identity theft. Speed matters here: an early report lets the IRS watch affected taxpayers' accounts for fraudulent returns.

Have this ready before the call:

• Firm name, EFIN, PTINs of the preparers involved.
• What happened and when it was found.
• What data may be involved and how many clients, even as a range.
• A list of affected taxpayers, or a commitment to deliver one.

The IRS page also lists the local FBI office, the Secret Service if directed, and a police report with local police. The FTC guide says to call local police immediately.

Day 1 to Day 2: Scope the data

The forensic work now answers the questions that drive every notice:

• Which systems and folders were accessed?
• Was data copied out (acquisition), or only viewed?
• Was it encrypted, and were keys or credentials also exposed?
• Whose information is in the affected set, and where do they live?

Build the affected-person list as a spreadsheet with name, state of residence, data elements involved and source folder. Every later notice is a filter on this list. Two numbers come from it: the count of consumers (for the FTC 500-person threshold) and the count by state (for state laws). The FTC notification event guide explains how to count.

Interview the people who found the incident and anyone else who may know about it, as the FTC guide suggests, and document those interviews.

Day 2: Contact state tax agencies

The IRS directs tax professionals to report breaches to the state tax agencies where they prepare returns, and points to the Federation of Tax Administrators page for state contacts. States run their own return fraud filters, so they need the same early warning the IRS gets.

Separately, assess state attorney general notices. The IRS page notes that most states require the attorney general to be notified of data breaches. Timing and thresholds vary by state; the state breach notification checklist sets out how to work through them.

Day 2 to Day 3: Plan client communication

Client notices usually go out after day 3, once scope is known, but the plan should be drafted now. The IRS suggests individual letters to affected clients and working with law enforcement on timing. The FTC guide stresses a communications plan that reaches all affected audiences and avoids misleading statements.

Prepare:

• A holding script for staff who answer client calls. Staff should not speculate about scope.
• A draft notice letter for counsel review.
• A decision on credit monitoring or identity protection. The IRS notes some states require offering it.
• A plan to notify the three credit bureaus, which the IRS lists as a step.

Day 3: Check the clocks

By the end of day 3 the incident lead should have a one-page status with each deadline:

Also confirm the firm can keep working. Tax deadlines do not move because of a breach. Decide which systems are cleared for use and who approves bringing each one back.

What comes after day 3?

Remediation, notices, an update to the WISP and a lessons-learned review. For firms that hold information on 5,000 or more consumers, the Safeguards Rule requires the incident response plan to cover evaluating and revising the plan after a security event (16 CFR 314.4(h)); smaller firms are exempt from that paragraph under 314.6 but should do the review anyway. Book that meeting before the incident closes, while details are fresh.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• Internal Revenue Service, Data theft information for tax professionals: https://www.irs.gov/individuals/data-theft-information-for-tax-professionals
• Federal Trade Commission, Data Breach Response: A Guide for Business: https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
• Legal Information Institute, 16 CFR 314.4, Elements: https://www.law.cornell.edu/cfr/text/16/314.4
• Federal Trade Commission, Safeguards Rule notification requirement now in effect: https://www.ftc.gov/business-guidance/blog/2024/05/safeguards-rule-notification-requirement-now-effect

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error