A ransomware group claims it stole 1.27 terabytes of files from INTAX, Inc., a Kentucky tax compliance firm, including client tax returns, accounting records, and employee passports and Social Security numbers. INTAX, Inc. has not confirmed the breach. Affected individuals should monitor credit reports, consider a credit freeze, and watch for tax fraud.
| Company | INTAX, Inc. |
|---|---|
| Industry | Finance |
| Data Types Exposed | Client Tax Returns, QuickBooks Accounting Records, Bank Account and Routing Numbers, Wire Transfer Forms, Signed W-9 Forms, US Passports, Driver’s License Numbers, Birth Certificates, W-2 Forms with Social Security Numbers, IRS Filings, Medical Insurance Cards, Cleartext Passwords |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the INTAX, Inc. Data Breach?
A ransomware group has publicly claimed responsibility for stealing a massive trove of files from INTAX, Inc., a Lexington, Kentucky-based property-tax compliance and bill-pay firm. The group says it took the company’s complete file server, totaling nearly 893,000 files and 1.27 terabytes of data. As of now, INTAX, Inc. has not publicly confirmed this incident.
According to the claim, the stolen archive includes hundreds of thousands of client tax return PDFs along with full QuickBooks accounting files for more than 100 client companies. The attackers also allege they obtained banking details, a six-figure wire transfer form, and identity documents belonging to the firm’s owner and employees. Because this report comes from the threat actor’s own leak-site posting, the full scope and accuracy of these claims remain unverified.
The exact timeline of when unauthorized access may have occurred has not been publicly disclosed. Similarly, there is no confirmed date for when INTAX, Inc. discovered or began investigating the alleged intrusion. Until the company issues its own statement, key details about the forensic response and the method of entry used by the attackers will remain unknown to the public.
Given the nature of the ransomware group’s claims, this INTAX, Inc. data breach report should be treated as allegations rather than established fact. However, the sheer volume and specificity of the data described, including named client companies, suggest the claim deserves serious attention from anyone connected to the firm.
Who was affected?
Based on the ransomware group’s claims, the affected population likely includes INTAX, Inc. employees, the firm’s owner, and clients whose tax and accounting matters the company handled. The attackers specifically named large organizations as clients, including AARP, ADT, Pilot Travel Centers, Wendy’s, Valvoline, Zions, and Raytheon, among roughly 100 companies total.
Because INTAX, Inc. reportedly manages property-tax compliance and bill-pay services for corporate clients, this means the exposure may extend beyond the company’s own staff. Employees of those client companies, as well as individuals connected to payroll and tax filings processed by INTAX, could also be impacted. The exact number of individuals affected has not been publicly disclosed.
It is also worth noting that the claimed data includes personal employee folders and family-related identity documents, such as birth certificates. This suggests the alleged exposure could reach beyond employees themselves to their household members. Since the incident remains unconfirmed by the company, the true scope of affected individuals cannot yet be determined with certainty.
What Information Was Potentially Exposed?
The ransomware group’s posting describes a wide range of sensitive data categories allegedly taken from INTAX, Inc. systems. These claims have not been verified by the company, but the specificity of the listed items is notable.
- Client tax returns (hundreds of thousands of PDF files)
- QuickBooks accounting files, including ledgers, bank details, and payroll records
- Bank account and routing numbers
- Wire transfer forms
- Signed W-9 tax forms
- US passports of the owner and employees
- Driver’s license numbers
- Birth certificates
- W-2 forms containing Social Security numbers
- IRS filings
- Medical insurance cards
- Cleartext password files for government tax portals and internal accounting systems
- Emails and personal employee folders
- Lawsuit records
If these claims prove accurate, the risk to affected individuals would be considerable. Social Security numbers combined with W-2 forms and IRS filings create a potent combination for tax-related identity theft. Criminals could use this data to file fraudulent tax returns, claim refunds in someone else’s name, or open new lines of credit.
In addition, the alleged exposure of passports, driver’s licenses, and birth certificates raises concerns about long-term identity theft risk. Because these documents rarely change, they can be exploited for years after a breach. The claimed presence of cleartext passwords to government tax portals is especially concerning, as it could allow further unauthorized access well beyond this single incident.
What is the company doing?
Because this incident stems from a ransomware group’s own claims, there is no confirmed public statement from INTAX, Inc. describing an investigation, remediation steps, or notification process. The company has not confirmed the breach occurred, and therefore no official response has been documented at this time.
As a result, it remains unclear whether INTAX, Inc. has begun notifying affected clients, employees, or regulators. It is also unknown whether the company has engaged a forensic security firm or taken steps to secure its systems following the alleged attack. Individuals connected to the firm should watch for official communication directly from INTAX, Inc. in the coming weeks.
Until a formal statement is issued, affected individuals should rely on verified notices rather than unconfirmed reports. For example, legitimate notification letters typically come by mail or official email and include specific details about what data was involved. Anyone who receives such a notice should read it carefully and retain a copy for their records.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone connected to INTAX, Inc., whether as an employee or a client of one of its corporate customers, should check their credit reports regularly. You can request free reports from all three major credit bureaus through AnnualCreditReport.com. Reviewing these reports helps you catch new accounts or inquiries you did not authorize.
Because the claimed data includes Social Security numbers and financial account details, ongoing vigilance is especially important here. Consider checking your reports every few months rather than just once. This way, you can catch suspicious activity early and limit potential damage.
Consider a Credit Freeze or Fraud Alert
Given the alleged exposure of Social Security numbers, bank account numbers, and other financial identifiers, a credit freeze is a strong protective step. A freeze prevents new creditors from accessing your credit file, which makes it much harder for criminals to open accounts in your name. You can place a freeze for free with each of the three credit bureaus.
Alternatively, a fraud alert requires creditors to take extra steps to verify your identity before extending credit. This option is less restrictive than a freeze but still adds a layer of protection. Because the claimed data includes passports and driver’s licenses, these added safeguards are worth the modest inconvenience.
Watch for Tax-Related Fraud
Because the ransomware group claims to have obtained W-2s, IRS filings, and tax returns, affected individuals should be alert to tax fraud specifically. If someone files a fraudulent return using your information, you may only discover it when your own legitimate return gets rejected. Filing your taxes early each year can help you beat scammers to the punch.
In addition, the IRS offers an Identity Protection PIN program that adds another layer of verification to tax filings. This means even if someone has your Social Security number, they cannot easily file a return without your PIN. Anyone connected to INTAX, Inc. should strongly consider enrolling in this program.
Stay Alert for Phishing Attempts
Whenever a data breach is claimed, scammers often follow up with phishing emails or calls pretending to be from the breached company or a related service. Be cautious of unexpected messages asking you to click links, verify account details, or provide personal information. Legitimate organizations rarely ask for sensitive data through unsolicited emails.
Instead, if you receive a suspicious message, contact the organization directly using a phone number or website you already trust. This simple habit can prevent you from falling victim to a secondary scam built on top of this incident. Because the claimed data includes email addresses and personal folders, targeted phishing attempts are a realistic concern here.
Consult a Data Breach Attorney
Given the scale and sensitivity of the data the ransomware group claims to have stolen, affected individuals may want to speak with an attorney who focuses on data breach cases. An attorney can help you understand your rights and whether you may be eligible for compensation. Many offer free initial consultations, so there is little downside to asking questions.
Furthermore, attorneys who handle these cases can help you track developments in any related legal action. This is especially useful if INTAX, Inc. or its clients later confirm details that were previously only alleged. Staying informed through a qualified professional can save you time and stress down the road.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.