HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedWire FraudGovernment IDIdentity (basic)Financial accountMediumContained

Khan Associates

bd_d8422fac59b26424 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2025

Filed

Oct 17, 2025

To disclose

13 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Khan Associates →

Khan and Associates CPA, Inc. notified clients that an unauthorized user accessed their third-party tax filing software, Intuit, starting around July 9, 2025, and filed fraudulent federal and state tax returns. The incident was discovered on July 16, 2025. Affected data included Social Security numbers, government IDs, names, and bank account information. The firm engaged IT specialists, notified law enforcement (FBI, Secret Service, IRS), and implemented MFA and credential resets. Credit monitoring is being provided.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 16, 2025 → Notified Oct 6, 202582d ✗ CA 60-day late13 weeks discovery → filing

Incident timeline

undetected · 7 days

discovery → filing · 13 weeks / 93 days

Jul 9, 2025

Begins

Jul 16, 2025

Discovered

Oct 17, 2025

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Khan Associates
norm: khan associates

Name: Khan Associates
norm: khan associates
Industry: Professional Servicesllm

Discovered: Jul 16, 2025
Breach occurred: Jul 9, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2025
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the IRSNotified the Secret ServiceFiled notification with California Attorney General
Third party: via Intuit
Initial access: trusted_relationship

During the incident: Engaged IT specialists to determine the full nature and scope of this incident
Terminate unauthorized access
Secure our network
Working with the IRS and the state tax agency concerning the fraudulent filing
Notified the FBI, IRS, and Secret Service of this incident
Changes made: Implemented additional security measures to further protect our network
Installing dual factor authentication on our network and on Intuit
Changing login credentials and passwords across all platforms
Reinforcing our firewall software
Providing Credit Monitoring Services via Kroll for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: CA 60-day late · 82d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 16, 2025
→ Notified: Oct 6, 2025
82d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 16, 2025 → Notified: Oct 6, 2025	82d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-613034
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 17, 2025
Raw hash: ff644323384c9a030b581876aadbda2aee2adf253116470434fecb3ddb3a1236

Reporting entityKhan Associates

Victim entityKhan Associates

Incidentdiscovered Jul 16, 2025

Stated responseEngaged IT specialists to determine the full nature and scope of this incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov