HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedWire FraudIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Khan & Associates
bd_d8422fac59b26424 · schema v1 · pii pii-v1
Full breach record for Khan & Associates →Khan and Associates CPA, Inc. notified clients that an unauthorized user accessed their third-party tax filing software, Intuit, starting around July 9, 2025, and filed fraudulent federal and state tax returns. The incident was discovered on July 16, 2025. Affected data included Social Security numbers, government IDs, names, and bank account information. The firm engaged IT specialists, notified law enforcement (FBI, Secret Service, IRS), and implemented MFA and credential resets. Credit monitoring is being provided.
California clockDiscovered Jul 16, 2025 → Notified Oct 6, 202582d ✗ CA 60-day late13 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-613034
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 17, 2025
- Raw hash
- ff644323384c9a030b581876aadbda2aee2adf253116470434fecb3ddb3a1236
Reporting entity
- Name
- Khan Associatesnorm: khan associates
- Domain
- cpaserv.com
Victim entity
- Name
- Khan & Associatesnorm: khan associates
- Domain
- khanassociates.com
Incident
- Discovered
- Jul 16, 2025
- Materiality determined
- —
- Notification sent
- Oct 6, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the FBINotified the IRSNotified the Secret ServiceFiled notification with California Attorney General
- Third party
- via Intuit
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 13 weeks(93 days from discovery to filing)
- Compliance flags
- CA 60-day late · 82d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 16, 2025→ Notified: Oct 6, 202582d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.