H & R BLOCK, INC.
ent_019e5b5ea0d283fdac850b9715bb6a72
Disclosures
13
State AG · 6 jurisdictions
Multi-filing incidents
3
incidents joining 2+ filings here
Max affected reported
25,566
nationwide · State AG IN
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- H & R BLOCK, INC.
- Normalized
- h r block— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 549300CE3KUCWLZBG404
- SEC EDGAR CIK
- 0000012659
- Domain
- None on record
Disclosure history (13)newest first
- Vermont State AGas victim2024-11-27
H&R Block notified Vermont consumers of a data breach where an unauthorized third party used stolen PII to access client accounts between May 13 and August 7, 2024. The incident involved names, SSNs, and financial data. H&R Block terminated access, engaged forensic experts, and offered 24 months of identity protection services.
- Indiana State AGas reporting2024-11-26
HRB Tax Group Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2024-05-13 and was reported on 2024-11-26. 899 Indiana residents were affected. 25,566 individuals affected in total.
- Montana State AGas victim2021-01-18
State of Montana Attorney General notice regarding H&R Block. The source document is a corrupted Word file containing no readable narrative, incident details, or data types. Extraction is limited to the entity name found in the metadata.
- Montana State AGas victim2020-07-31
State AG filing for H&R Block in Montana. The source document is a corrupted Word document containing no readable breach narrative, dates, or data types. No extraction possible.
- Indiana State AGas victim2020-02-21
H&R Block LLC reported a data breach to the Indiana Attorney General. The breach occurred on 2020-01-23 and was reported on 2020-02-21. 1 Indiana residents were affected. 18 individuals affected in total.
- Massachusetts State AGas victim2020-02-14
H&R Block LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-02-14. 2 Massachusetts residents were affected. The report records the breach type as electronic.
- Montana State AGas victim2019-05-08
H&R Block notified Montana residents of a data breach where unauthorized parties used stolen credentials from a non-H&R Block source to access MyBlock accounts containing tax return data (names, SSNs, DOBs) between March 1-23, 2019. H&R Block revoked access and offered 12 months of identity protection.
- Montana State AGas victim2019-04-08
H&R Block notified Montana clients that their tax documents, including SSNs and W-2 data, were briefly visible to another client due to unauthorized access. The incident involved credential misuse. H&R Block offered 12 months of identity protection and two years of tax preparation services.
- Washington State AGas victim2018-05-09
H&R Block (McSwain, LLC) reported the theft of documents containing client PII (names, SSNs, addresses) from a transport vehicle in Auburn, WA. 2,655 Washington residents were affected. The incident was discovered on April 21, 2018, and notifications were sent on May 9, 2018. 12 months of identity protection was offered.
- New Hampshire State AGas victim2016-05-16
H&R Block notified New Hampshire AG of a potential data security incident involving up to 5 NH residents. A former Expat Tax Services employee copied client files (names, addresses, SSNs) to an external hard drive to start a competing business. The employee returned the data; no evidence of use was found. Forensic investigation and legal action were initiated.
- Massachusetts State AGas victim2014-02-18
H&R Block reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2014-02-18. 218 Massachusetts residents were affected. The report records the breach type as paper.
- Massachusetts State AGas victim2014-02-18
H&R Block reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2014-02-18. 218 Massachusetts residents were affected. The report records the breach type as paper.
- Massachusetts State AGas victim2008-06-05
H&R Block reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2008-06-05. 16 Massachusetts residents were affected. The report records the breach type as electronic.
Subsidiary disclosures (newest 10)filed by group companies
◈ These filings were made by or about subsidiaries of H & R BLOCK, INC. — not by H & R BLOCK, INC. itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.
- Massachusetts State AGvia HRB Tax Group, Inc.2024-12-27
HRB Tax Group, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-12-27. 38 Massachusetts residents were affected.
- California State AGvia HRB Tax Group, Inc.2024-12-27
H&R Block notified customers that an unauthorized third party used personally identifiable information obtained from external sources to access client accounts between May 13, 2024, and August 7, 2024. The incident was discovered on August 9, 2024. Affected data may include names, Social Security numbers, ITINs, government-issued ID numbers, financial account information, and dates of birth. H&R Block engaged third-party experts, terminated unauthorized access, and is offering 24 months of identity theft protection services.
- Washington State AGvia HRB Tax Group, Inc.2024-12-19
H&R Block notified Washington AG of unauthorized access to client accounts between May 13 and August 7, 2024. The attacker used stolen PII to gain access. Data exposed included names, SSNs, tax info, and financial accounts. 889 Washington residents affected. Incident discovered August 9, 2024; notifications sent November 26, 2024.
- Maine State AGvia HRB Tax Group, Inc.2024-12-19
HRB Tax Group, Inc. reported a data breach where an unauthorized third party used stolen PII from external sources to access client accounts between May 13 and August 7, 2024. Discovered August 9, 2024, the incident affected 23,067 individuals, including 24 in Maine. Data accessed included names, SSNs, and financial info. Notices sent November 26, 2024, offering 24 months of identity protection.
- Massachusetts State AGvia Emerald Financial Services, LLC2024-11-27
Emerald Financial Services, LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-11-27. 60 Massachusetts residents were affected.
- Montana State AGvia HRB Tax Group, Inc.2024-10-03
H&R Block notified Montana residents on September 24, 2024, of a data incident occurring August 5-7, 2024. An unauthorized third party used stolen PII from external sources to access client accounts. Affected data included names, SSNs/ITINs, and financial info. H&R Block engaged forensic experts, terminated access, and offered 24 months of identity protection services.
- Indiana State AGvia HRB Tax Group, Inc.2020-06-18
HRB Tax Group, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2020-02-16 and was reported on 2020-06-18. 3 Indiana residents were affected. 132 individuals affected in total.
- Massachusetts State AGvia HRB Tax Group, Inc.2020-06-17
HRB Tax Group, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-06-17. 4 Massachusetts residents were affected. The report records the breach type as electronic.
- Massachusetts State AGvia HRB Tax Group, Inc.2020-05-19
H&R Block Tax Group, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-05-19. 1 Massachusetts residents were affected. The report records the breach type as paper.
- Massachusetts State AGvia HRB Tax Group, Inc.2020-01-08
HRB Tax Group Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-01-08. 5 Massachusetts residents were affected. The report records the breach type as paper.