ON August 13, DataBreaches was contacted by an anonymous source who claimed to have acquired over 2 million records from TaxAct, including clients' phone numbers, usernames, and email addresses. While some phone numbers were reported as fake, the source highlighted vulnerabilities in TaxAct's API that allowed unauthenticated access to sensitive data. DataBreaches attempted to contact TaxAct but received no effective response after initial communication.
The situation raises serious concerns regarding TaxAct's data security practices, especially given the company's claims about safeguarding personal information. A leak of 450,000 additional records was also discovered on a Russian-language forum. The incident poses a risk of increased phishing attempts, and there are calls for TaxAct to publicly address the breach and improve security.