Social EngineeringProfessional ServicesProfessional ServicesPhishingBackdoor / C2TargetedData ExfiltratedPIIIdentity (basic)LowContained

Corridor Taxes

bd_9274ca64e2202253 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 11, 2025

Filed

Sep 6, 2025

To disclose

8 weeks

Affected

6scope not determined

Confidence

66%

Full breach record for Corridor Taxes →

Corridor Taxes experienced a phishing attack leading to ScreenConnect backdoor installation on a single PC between July 11 and August 6, 2025. Fewer than six clients' PII was at risk. The incident was contained, credentials reset, and MFA enforced. Notifications are planned per IRS/state requirements.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 57 days

Jul 11, 2025

Begins

Jul 11, 2025

Discovered

Sep 6, 2025

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident

Name: Corridor Taxes
norm: corridor taxes

Name: Corridor Taxes
norm: corridor taxes
Industry: Professional Servicesllm

Discovered: Jul 11, 2025
Breach occurred: Jul 11, 2025 – Aug 6, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 6scope not determined
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1071 Application Layer Protocol
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: The affected PC was isolated, its drive removed and retained, BIOS reset, and a new drive with clean OS/software installed.
Outbound connections to attacker IPs and ports were blocked.
User and administrative credentials were reset with MFA enforced.
Identified QC clients were prioritized for breach notifications, following IRS and state requirements.
The PC BIOS was reset.
MFA is enforced on all critical accounts (IRS e-Services, state DoR, and file server).
Changes made: User security awareness training identified as a next step.
Reduce Admin account and limit admin logins when only required for software update/installation.
Implement endpoint detection and response (EDR) with tamper protection.
Conduct a formal Written Information Security Plan (WISP) review and update.
Use a segregated workstation for IRS/state filings that is not used for email or web browsing.
Expand central log collection and retention; ensure reliable forwarding to NAS/SIEM.
Nightly shutdown and user sign-out to reduce remote exposure.
Ongoing user training on secure practices and phishing recognition.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/962025_Corridor_Taxes_Redacted_2F24E7A5F119D.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2025
Raw hash: bba52dd9c49062bc8320a803be4a19919ade3a5df9c19c6a8686bf86daed61bf

Reporting entityCorridor Taxes

Victim entityCorridor Taxes

Incidentdiscovered Jul 11, 2025

Stated responseThe affected PC was isolated, its drive removed and retained, BIOS reset, and a new drive with clean OS/software installed.

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov