More than 2 million user records from TaxAct allegedly acquired; 450k already leaked (1)
An anonymous source contacted DataBreaches in August claiming to have obtained more than 2 million records from TaxAct, including usernames, email addresses, and phone numbers. Around 450,000 of those records have reportedly already been published or shared.
Why this matters: TaxAct holds some of the most sensitive data that exists: income, employment, dependents, bank details. People do not choose to hand it over casually — they hand it over because filing taxes is a legal requirement. If this breach is real, affected users face phishing, account takeover, and identity fraud at tax time, which is exactly when criminals want your financial details. TaxAct has not confirmed the incident. That silence is its own problem.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.