HackingTechnologyFinancial ServicesInformationStolen CredentialsCustomer Data InvolvedData ExfiltratedCredentialsPIIIdentity (basic)Government IDFinancial accountMediumContained

Taxact, Inc.

bd_0ce5abb02c7ee516 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 12, 2016

To disclose

—

Affected

Not disclosed

Confidence

83%

All records for Taxact, Inc. →2 incidents on file

Account takeover notice

Taxact, Inc. notified customers of unauthorized access to their accounts. The filing says: “We have no evidence that any TaxAct system has been compromised and believe the third party used username and password combinations obtained from sources outside of our own system.”

TaxAct (operated by Blucora, Inc.) experienced unauthorized account access between November 10 and December 4, 2015, in which an external third party used stolen credential combinations sourced outside TaxAct's systems to access user accounts. Affected accounts may have had tax returns opened or printed, potentially exposing names, SSNs, addresses, driver's license numbers, and bank account information. Accounts were disabled and credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 10, 2015

Begins

Jan 12, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Blucora, Inc. (TaxAct)
norm: blucora inc taxact

Name: Taxact, Inc.
norm: taxact
Industry: TechnologyllmFinancial Servicesllm

Discovered: —
Account access: Nov 10, 2015 – Dec 4, 2015
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: CredentialsPIIIdentity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1110.004 Credential Stuffing
Threat actor: ExternalFinancial
Regulator citations: Working with the IRS and state regulators to identify new security measuresNotified California Attorney General
Initial access: valid_credentials

During the incident: Temporarily disabled affected accounts to stop unauthorized access
Investigated the incident
Reviewed website logs for account activity after attempted access
Offering free credit monitoring and restoration services through ID Experts® (12 months of credit monitoring, $1,000,000 insurance reimbursement policy)
Working diligently with the IRS, state regulators and other tax software providers to identify new security measures
Changes made: Taken the necessary steps to prevent this unauthorized access from recurring as well as mitigate its effect
Required password changes and additional security questions to re-enable accounts
Recommended affected users obtain an Identity Protection PIN (IP PIN) from the IRS
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-59569
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2016
Raw hash: 5f0cfe60ae00f8bdb098e5ce048a0c146ba5c628a6732429878009d4dda32597

Reporting entityBlucora, Inc. (TaxAct)

Victim entityTaxact, Inc.

IncidentUnauthorized Access

Stated responseTemporarily disabled affected accounts to stop unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov