The Texas Attorney General publishes data security breach notices for incidents affecting Texans. Filtering that public database to CPA and tax firms currently shows 7 notices affecting 7,456 Texans (7 of those reports in 2026). Data is current through Aug 21, 2026.
Texas CPA & Tax Firms in the OAG Breach Database
| Firm | City | Texans Affected | Date Published |
|---|---|---|---|
| Forrestall CPAs LLC | Sugar Hill | 3,725 | Aug 21, 2026 |
| Finch CPA Firm PLLC | Spring | 280 | Jun 22, 2026 |
| Allred Tax Advisors, PLLC | Conroe | 781 | Jun 5, 2026 |
| Dana Lee CPA LLC | Spring | 150 | Mar 27, 2026 |
| Mercadien PC Certified Public Accountants | Hamilton Township | 1,323 | Feb 24, 2026 |
| AA CPA Tax Strategies LLC | Austin | 750 | Jan 27, 2026 |
| Carranco & Lawson, P.C. | Laredo | 447 | Jan 13, 2026 |
The exposed data across these notices includes names, addresses, Social Security numbers, driver’s license numbers, and financial account information — exactly the data a tax preparer holds for every client.
Why This Matters for CPA & Tax Firms
The IRS (Publication 4557) requires every tax professional to maintain a written information security plan (WISP) to keep a PTIN, and the FTC Safeguards Rule backs it with civil penalties up to $50,120 per violation, per day. A breach of taxpayer data is both a regulatory and a reputational event few small practices survive.
Check your firm’s email and domain security at audit.emailmenow.com/?industry=cpa-firms&state=texas.
Recommendations
- Enforce DMARC (
p=reject), strict SPF (-all), and DKIM signing. - Add MTA-STS and website security headers; require MFA on anything touching client returns.
- Document your WISP and run recurring security awareness training before filing season.
Related trackers
- Texas OAG YTD dashboard
- Financial services tracker
- Law firm breach tracker
- Healthcare AG breach tracker
- Washington healthcare breaches (2026)
- Washington law firm breaches (2026)
- CA September roundup
- TX September roundup
- WA August roundup
- TX Parks breach
- Have I Been Pwned
- HIBP September roundup
- Breach data week (September)
- HHS OCR August roundup
- SEC 8-K September roundup
- Monitoring guide
- All trackers
Protect your firm and your clients. Contact EmailMeNow IT Consulting for your IRS-ready written security plan and email hardening.