Tax preparer data theft: what to do and who to tell

Leer en español

Two sets of text say who to tell when client data is stolen or lost at a tax office. IRS Publication 5708 has a sample list of people to notify. The FTC Safeguards Rule, 16 CFR Part 314, requires a notice to the FTC. State laws may require other notices, including to your clients.

Who Publication 5708 says to notify

Sample Attachment C says that if the Data Security Coordinator determines personal information was stolen or lost, the firm notifies the groups below. It describes the theft or loss in detail and works with authorities.

• The IRS Stakeholder Liaison, who coordinates IRS divisions and other agencies on a tax professional office data breach.
• The state Attorney General's office.
• State tax agencies. The publication points to a state-by-state "Report a Breach" resource.
• The FBI's Internet Crime Complaint Center, if it is a cyber-crime involving electronic data theft.
• The Federal Trade Commission, under the Safeguards Rule.
• Local law enforcement, your tax software vendor, your liability insurance carrier and legal counsel.
• The victims, to the extent required by regulatory laws and good business practices.

This is a sample attachment, so the list itself is a suggestion. Some items on it can still be legal duties: the FTC notice below, and any notice to clients or a state that your state's breach law requires. Publication 5708 also names an "IRS Data Theft Reporting Process" among its resources. We did not read that page or any state law for this guide.

The FTC notice the rule requires

If a notification event involves the information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery. You do it electronically on a form on the FTC website. The notice includes:

• your name and contact information;
• the types of information involved;
• the date or date range, if it can be determined;
• the number of consumers affected or potentially affected;
• a general description of the event; and
• whether a law enforcement official gave you a written determination that telling the public would impede a criminal investigation or damage national security, and how the FTC can contact that official.

An event counts as discovered on the first day it is known to you. You are treated as knowing if any employee, officer or other agent knows, other than the person committing the breach.

A notification event is acquisition of unencrypted customer information without the authorization of the person it concerns. Information counts as unencrypted if an unauthorized person accessed the key. Unauthorized access is presumed to include acquisition unless you have reliable evidence that acquisition did not happen or could not reasonably have happened.

This duty took effect May 13, 2024. Section 314.6 does not exempt it, so it applies to a small office whose event involves 500 or more consumers.

A check Publication 5708 suggests

Check your EFIN activity report in IRS e-Services for more returns than you transmitted. Look for returns sent at odd hours, such as overnight or on weekends, or on a Monday or Tuesday morning. The publication says a thief typically steals data over a weekend and transmits reworked returns just after it.

Plan before it happens

Publication 5709 says the IRS recommends a data theft response plan that includes contacting your IRS Stakeholder Liaison. Publication 5708 says a plan should list the steps to re-secure your devices, data, passwords and networks, and who takes them. The rule requires a written incident response plan for offices with 5,000 or more consumers. See the Safeguards Rule guide for the rest of the rule.

Sources

• 16 CFR 314.2, 314.3, 314.4, 314.5, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• IRS Publication 5709 (Rev. 5-2024): irs.gov/pub/irs-pdf/p5709.pdf

This is general information, not legal advice.