HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancialMediumContained

CMC Tax Services

bd_0affb0e38e3c3d91 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 20, 2021

To disclose

—

Affected

Not disclosed

Confidence

65%

Full breach record for CMC Tax Services →

CMC Tax Services, Inc. disclosed that an unauthorized third party accessed its network between November 30, 2020, and May 17, 2021. The breach resulted in the fraudulent filing of 2020 tax returns for a limited number of clients. Affected data included full names, Social Security numbers, and personal information of spouses and dependents. The company notified the IRS, engaged cybersecurity professionals, and offered one year of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 30, 2020

Begins

Jul 20, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: CMC Tax Services
norm: cmc tax
Domain: cmctaxservices.com

Name: CMC Tax Services
norm: cmc tax
Domain: cmctaxservices.com
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Nov 30, 2020 – May 17, 2021
Materiality determined: —
Notification sent: Jun 20, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Internal Revenue Service

During the incident: Commenced an investigation
Notified the Internal Revenue Service
Engaged external cybersecurity professionals to analyze internal systems
Filed an Identity Theft Affidavit (Form 14039) with the IRS on behalf of affected clients
Offered complimentary one-year membership of Experian IdentityWorks Credit 3B
Changes made: Continually evaluate and modify practices to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-543068
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 20, 2021
Raw hash: f0bfc14047ec0431ec64cd8b0719870319bf38623bb91838da4f468f183834c0

Reporting entityCMC Tax Services

Victim entityCMC Tax Services

IncidentUnauthorized Access

Stated responseCommenced an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov