A CPA firm tried to file client tax returns and received rejections: returns had already been filed. Yet the firm had not submitted them.
That was how a CPA described discovering a breach that happened in June, after the first tax-season rush and before the next busy period.
The firm had an IT provider and security software. According to his account, the provider learned about the problem from him—not the other way around.
The lesson for firm leaders: verify the protections you rely on, and understand what support your insurance would provide if an incident still occurs.
One computer had lost its protection
The CPA said an investigator working through the insurer later identified a failed security-software update on an employee’s computer. The computer had been left without its intended protection. The employee subsequently clicked something malicious, and the computer was compromised.
According to his account, attackers stole client tax information, including unfiled returns, and used it to submit fraudulent returns with altered refund instructions.
He repeatedly described the experience as a nightmare he never wanted to go through again.
We do not know how long the protection was missing or whether a particular check would have prevented the attack. But the account raises a question every firm can ask:
Would we know if a protection we rely on was no longer there?
Installed is not the same as still working
A useful coverage review starts with the firm’s current list of users and computers, then compares that list with the protections actually operating.
Reviewing only the devices visible in a security dashboard does not establish whether any intended devices are missing. The comparison needs to include what should be protected—not just what is still reporting.
This is central to Cyber Defensibility, IT Assure’s managed cybersecurity service. We implement and manage defined security controls, validate their operation and coverage monthly, correct routine in-scope gaps, verify the corrections, and report what still needs attention.
Monthly validation complements monitoring; it does not guarantee immediate detection or prevent every incident. The purpose is to maintain and repeatedly check protection rather than assume the original installation remains effective.
Insurance mattered when the incident became real
The CPA also emphasized how valuable the firm’s insurance had been.
He said the insurer helped guide the firm and its clients through the claims process, provided identity protection for affected clients, and paid incident-related claims.
His assessment of the annual insurance expense was emphatic: it had been worth it.
That value was both financial and practical. The firm had help navigating the aftermath, and affected clients received assistance. Yet having insurance did not make the experience something he wanted to repeat.
Managed cybersecurity and cyber insurance are complementary—not interchangeable. Cyber Defensibility manages and validates defined protections. Appropriate insurance can help address some of the financial consequences that remain when an incident occurs.
The aim is preparation before and after an incident, not a promise of complete protection or automatic claim payment. Another firm’s coverage and available assistance must be confirmed with its own insurance professional.
Three questions for your IT provider and insurance advisor
1. How frequently do you evaluate whether all our users, computers, and accounts still have the security protections they should have?
Ask your IT provider for a defined schedule, what gets checked, and the results of the most recent review—including any gaps. “We monitor everything” does not explain how regularly actual coverage is compared with the full intended environment.
2. If security protection on one computer fails, is removed, or stops reporting, how would you know—and how quickly?
Ask your IT provider how missing or failed protection is detected between scheduled reviews. Monitoring for threats and checking whether the protection itself remains active are different questions.
3. If a breach like this happened to our firm, what would our insurance cover—and what circumstances could limit or exclude coverage?
Ask your broker or insurer to walk through the scenario using your actual policy. Clarify what help would be available to the firm and affected clients, which costs would be paid, and what would remain your responsibility.
Include exclusions, limits, deductibles, and security or incident-reporting requirements. Specifically, ask how failed or missing security protection could affect coverage—rather than assuming either automatic payment or automatic denial.
Check the assumptions before the next busy period
Having an IT provider, security software, and insurance should start the conversation—not end it.
IT Assure’s Quick Self-Check helps you identify questions about cybersecurity ownership and coverage worth following up. It is a self-assessment based on your answers, not a technical test of your systems.
Prefer a direct conversation? Book a Cybersecurity Review to discuss how your firm’s cybersecurity is managed and whether further validation would be useful.
