In early September 2026, Knoxville CPA firm Brown, Jake & McDaniel, P.C. began notifying people that an unauthorized actor may have downloaded files containing their personal information — after a January intrusion. About 43,605 individuals were affected. If your firm still moves W-2s and returns over email, that is not a theoretical risk. It is the same exposure pattern showing up across accounting and financial advisory practices this year.
Last verified: September 13, 2026. Primary sources: Brown, Jake & McDaniel, P.C. consumer breach notice and state AG filings (Sept. 2026); IBM Cost of a Data Breach Report 2025; Accounting Today (Jan. 6, 2026); IRS Publication 4557; IRS Publication 5708; FTC Safeguards Rule (16 C.F.R. Part 314).
What happened at Brown, Jake & McDaniel
According to the firm’s consumer notice and reports filed with state attorneys general, Brown, Jake & McDaniel became aware of unusual network activity on January 20, 2026. Investigators concluded an unauthorized actor accessed the network between January 13 and January 21 and may have downloaded certain files. The firm finished identifying affected individuals on August 13, 2026, then mailed notices in early September.
Reporting tied to those filings puts the affected population at about 43,605 people. Data types described in the Massachusetts and Texas materials include names, Social Security numbers, financial-account information, and driver’s license numbers. That is textbook taxpayer return information — exactly the category IRC §7216 and §6713 treat as high-stakes if it is mishandled.
Seven months from intrusion to notice is not unusual for forensic review. It is also a long window for identity-theft risk to sit with clients who had no idea anything was wrong.
The 2026 pattern is bigger than one Tennessee firm
Brown, Jake & McDaniel is a news peg, not an outlier. Earlier in 2026, threat actors claiming affiliation with ShinyHunters publicly asserted they had taken more than 800,000 records from CFGI Management, a U.S. financial consulting firm. Independent breach-data analyses later described a smaller set of unique contact records circulating from that incident. The exact count is disputed. The lesson is not.
Attackers are treating firms that hold SSNs, bank details, and tax returns as high-value targets. Accounting Today reported in January 2026 that CPA firms face on the order of 300 cyberattack attempts per week, with activity rising sharply in peak filing season. Vendor and industry write-ups commonly put the tax-season figure near 900 attempts per week. Treat those as directional pressure gauges, not a guarantee about your specific inbox — but do not ignore the seasonal spike.
Cost is not abstract either. IBM’s Cost of a Data Breach Report 2025 put the global average breach cost at $4.44 million. For U.S. organizations in the same report, the average climbed to about $10.22 million. A mid-size Colorado firm may not land at the IBM average. It also does not take a nine-figure event to wreck a practice: notification costs, credit monitoring, downtime, cyber-insurance deductibles, and lost clients add up fast.
Where most firms actually leak data
Network intrusions make headlines. Day-to-day exposure is quieter.
Clients still email PDFs of W-2s, 1099s, and prior-year returns. Staff still reply with draft returns as attachments. Shared drives get forwarded. Consumer chat apps get used “just this once” during March. None of that looks like a breach until the mailbox is compromised, a laptop walks out of the office, or a phishing link turns one bad click into a full mailbox exfiltration.
Email was never designed to be a vault for taxpayer data. If your intake process depends on it, your firm’s exposure is not limited to a sophisticated nation-state actor. It includes every forwarded thread and every staffer who works from a coffee-shop Wi-Fi.
5 signs your firm is a breach target
- Clients still email tax documents as regular attachments. If that is how documents arrive, attackers do not need your server. They need one compromised inbox.
- Staff use personal email or consumer file-sharing for “urgent” client files. Shadow channels bypass your WISP, your logging, and often your insurance questionnaire.
- You cannot answer, in writing, where client files live and who can access them. IRS Publication 4557 and Publication 5708 expect you to inventory systems that hold taxpayer data. Vague answers fail that test.
- Your WISP exists as a PDF nobody opened since last year’s EFIN renewal. Under the FTC Safeguards Rule, a Written Information Security Plan is not optional theater. It has to match how the firm actually works.
- You have no MFA on email, portals, or remote access — or MFA is “encouraged” instead of required. Phishing and business-email compromise remain the boring, effective path into accounting practices.
If two or more of those land, treat September’s headlines as a rehearsal, not someone else’s problem.
What the rules already expect from you
You do not need a new statute to know this matters. Preparers are pointed to IRS Publication 4557 for safeguarding taxpayer data and Publication 5708 for building a WISP. The FTC Safeguards Rule (Gramm-Leach-Bliley) requires safeguards for customer information. IRC §7216 and §6713 attach criminal and civil exposure to unauthorized use or disclosure of return information.
None of those publications say “email is fine if you are busy.” They say protect the data, control access, and plan for incidents.
| Channel | Typical risk | Better default |
|---|---|---|
| Unencrypted email attachments | Mailbox compromise, forwarding, retention you do not control | Encrypted upload / firm-controlled intake with access logs |
| Consumer cloud links | Wrong permissions, personal accounts, no firm audit trail | Enterprise tools your WISP names and your staff are trained on |
| SMS/WhatsApp photo dumps with no process | Untracked PII sitting on personal phones | Guided secure intake with bilingual prompts and retention rules |
How Denver-area firms can cut the email attack surface
For practices in the Denver metro and Front Range — especially bilingual shops juggling English and Spanish clients under tax-season volume — the fastest exposure cut is usually intake. Stop asking clients to attach a W-2 to an email. Give them one secure place to send documents, confirm receipt, and keep the file inside a system you can actually audit.
That is the lane XyloDocs is built for. XyloDocs is an AI client communication platform for tax firms: bilingual calling, SMS, WhatsApp, proactive status updates, and secure document intake with access controls and audit trails built to align with IRS Publication 1075 safeguards. It does not replace your firewall, EDR, or cyber policy. It does remove the habit of treating email as a document vault.
If you want the plain-language version of why email fails this test, read Is it safe to email tax documents? and How to send tax documents securely.
Frequently asked questions
Did Brown, Jake & McDaniel confirm ransomware?
Public notices describe unauthorized network access and potential file download. As of the early September 2026 reporting used for this article, no ransomware group had publicly claimed that incident.
Is the $4.44 million figure what my firm would pay?
No. IBM’s $4.44 million figure is the 2025 global average across studied organizations. U.S. averages in the same report were higher. Your cost depends on size, records exposed, response speed, and insurance. Use the number as a scale check, not a quote.
Does a secure intake tool replace a WISP?
No. Tools support the plan. You still need written procedures, access controls, vendor vetting, training, and incident response under the FTC Safeguards Rule and IRS guidance.
What should we do this week?
Inventory where client files actually live. Turn MFA on everywhere it is missing. Stop accepting email attachments as the primary intake path. Update the WISP to match reality, not last year’s template.
Close the obvious hole before tax season
Brown, Jake & McDaniel’s notices are a reminder with a date stamp: firms that hold SSNs get hunted, and cleanup takes months. You cannot control every attacker. You can control whether client documents spend their lives in email.
If you want to see secure, bilingual document intake against your own workflow, review XyloDocs security controls or book a walkthrough.
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.