HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountPHIMediumContained

UnTax

bd_5a3352372c4b7d2e · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 13, 2023

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for UnTax →

UnTax dba TaxPlus disclosed a data breach where hackers used stolen credentials to access tax preparation software from August 24-26, 2023. The breach exposed Social Security Numbers, dates of birth, addresses, bank account numbers, and health insurance policy information for clients. The company contained the breach to a single workstation, notified the IRS and FBI, and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 24, 2023

Begins

Dec 13, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: UnTax
norm: untax
Domain: taxplus.com

Name: UnTax
norm: untax
Domain: taxplus.com
Also named: UnTaxdba oflegal entity
TaxPlusdba oftrade name
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Aug 24, 2023 – Aug 26, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountPHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Opened an investigation with the IRSFiled a criminal complaint with the Internet Crime Complaint Center (IC3) of the FBI
Initial access: valid_credentials

During the incident: Reviewed data security policies
Providing additional training to all staff on combating the techniques hackers and scammers use to gain access to secure systems
Investigated computer systems
Implementing further technological roadblocks in cooperation with our 3rd party service providers
Opened an investigation with the IRS
Filed a criminal complaint with the Internet Crime Complaint Center (IC3) of the FBI
Offering complimentary access to Experian IdentityWorks for 12 months
Changes made: Reviewed data security policies
Providing additional training to all staff on combating the techniques hackers and scammers use to gain access to secure systems
Implementing further technological roadblocks in cooperation with our 3rd party service providers
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-577840
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2023
Raw hash: 7f1b3c41de8905365f02c578e36a4fb6c2462f0aa1d1408a7bf7a3d2ca666638

Reporting entityUnTax

Victim entityUnTax

IncidentUnauthorized Access

Stated responseReviewed data security policies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov