Ransomware Hits Accounting Firms in Season. Here Is Why, and What Stops It.

Accounting firms get hit harder during filing season, and it is not coincidence. The value of what you hold peaks, your tolerance for downtime collapses, and everyone in the building is too busy to be careful. Attackers understand all three.

How it actually starts

Almost never a dramatic technical breach. Usually one of three things.

Someone opened an attachment that looked like a client document during a week when three hundred client documents arrived.

A password that had been reused turned up in a breach dump, and the account had no second factor.

Remote access was exposed to the internet, often set up quickly in 2020 and never revisited.

What actually happens next

The pattern is consistent. Access is quiet for days or weeks. Backups are found and deleted or encrypted first, because attackers know that is the thing that saves you. Data is copied out before anything is encrypted, so that refusing to pay still carries a threat. Then the encryption, usually at a weekend.

That order matters, because it explains why the two controls that help most are about backups and detection rather than prevention.

The four things that make the difference

A backup they cannot reach. Offline, or immutable, or in an account with separate credentials. If your backup is on the same network with the same logins, assume it goes with everything else.

A restore you have actually tested. The question is not whether the backup ran. It is whether you have watched someone bring a system back and know how long it takes.

Multi factor authentication everywhere. It closes the stolen password route, which is one of the three ways in.

Logging you can look at afterwards. Because the first question will be what left the building, and a firm that cannot answer has to assume the worst and notify accordingly.

The uncomfortable part about paying

Paying does not reliably get your data back and does not stop it being published. Firms that recover well are firms that could restore. Firms that pay are usually firms that could not.

That is the entire argument for spending the money on backups in October instead.

What to do this week

Test one restore. Check where your backups live and whether the same credentials reach them. Confirm multi factor authentication on email and remote access. That is an afternoon, and it changes what a bad day looks like.