Accountants are often the quiet map of a family's financial life. They know the entities, dependents, filings, advisers, assets, payroll records, tax positions, payment instructions, document portals, and recurring deadlines that keep the family office moving.
Ransomware.live listed Todd, Hamaker & Johnson LLP in an Akira entry on 30 June 2026. The listing described a Texas tax, accounting, audit, and financial guidance firm and claimed 40 GB of data coming, including passports, Social Security numbers, driver licenses, detailed financials, client financials, confidential client documents, contracts, and agreements. Incident type: ransomware/extortion listing involving an accounting and tax adviser.
For private clients, the accounting adviser can be more operationally useful to an attacker than a public-facing company system. Tax files and accounting records show which entities exist, who controls them, which payments recur, which banks are used, which documents are expected, and which people normally approve financial work.
Immediate exposure points
Tax and accounting records can identify entity names, ownership structures, dependents, addresses, payroll data, passports, tax IDs, bank references, contracts, agreements, loan documents, invoices, distributions, and financial statements. Those records can support impersonation, wire redirection, payroll fraud, document theft, and account recovery attempts.
The risk is not limited to large family offices. A small regional tax firm can hold the same useful facts as a larger adviser. If a criminal knows the tax preparer, the entity, the payment deadline, the document packet, and the person who usually approves it, they can send a request that looks like normal administrative work.
Secvred control layer
Secvred would map every tax, accounting, bookkeeping, payroll, audit, entity-administration, and document-portal relationship around the principal and family. It would identify who can request payments, release documents, upload tax records, reset portal access, approve payroll changes, update bank details, or send financial statements.
Secvred would remove stale adviser and staff access, segment document portals by role, reduce unnecessary copies of passports and identity records, and separate payment authority from tax-document access. Any request naming an entity, tax deadline, accountant, document packet, contract, payroll file, or payment history would still require independent verification before money moves or records are released.
Secvred would also monitor adviser ransomware listings, exposed credentials, domain abuse, and leaked accounting references. If an adviser appears in an extortion listing, Secvred would tell the family office which facts can no longer be trusted as proof and which approval paths need temporary lockdown. After that, attacker-held accounting context cannot quietly become authority.
Operational follow-through
Build an adviser-file exposure map. Include tax preparers, bookkeepers, auditors, payroll providers, entity administrators, corporate-service providers, family-office consultants, document portals, and shared folders. Mark which records each party holds and which actions each party can trigger.
Then lock the approval paths. No tax deadline, entity name, accountant name, bank reference, passport copy, invoice history, or financial statement should approve a payment or document release by itself. Accounting work is full of routine requests. That is exactly why the controls need to be written down before a breach makes the routine request dangerous.