Highlights

  • The ATO has warned tax professionals about cyber criminals targeting practices through malicious links, attachments and other communications.
  • The alert followed Fraud affecting a small number of tax professional systems, while the ATO said its own systems were not compromised.
  • Recommended safeguards include multi-factor authentication, software updates, antivirus protection, tested backups and staff awareness.
  • Tax practices should act quickly if a breach is suspected, especially where client identity information may be exposed.

The Australian Taxation Office has warned tax professionals to be on guard against cyber criminals targeting their practices through malicious emails, links and attachments.

In an alert published in August 2026, the ATO said it had identified fraud affecting a small number of tax professional systems and urged practitioners to strengthen their cyber security controls.

Importantly, the ATO said its own systems were not compromised and that the identified event had been contained, although monitoring was continuing.

The threat

Cyber criminals are targeting tax practices using malicious links in emails, attachments and other communications.

The ATO specifically warned that malicious links can be embedded in documents such as Job applicant CVs, making apparently routine Business communications a potential attack vector.

Tax practices are attractive targets because they hold concentrated stores of sensitive information, including client identity details, tax records and financial data.

A successful compromise can therefore expose not only the practice itself but also multiple clients at once.

How to protect your practice

The ATO recommends several practical cyber security measures.

Practices should:

  • install and regularly update antivirus software;
  • avoid opening unexpected links, attachments or downloads;
  • independently verify suspicious communications using trusted contact details;
  • enable multi-factor authentication across relevant systems and services;
  • keep operating systems, applications and devices updated; and
  • regularly back up important business data and test that it can be restored.

These controls should apply consistently whether staff are working from the office, remotely or across hybrid arrangements.

Cyber security is most effective when it is treated as an everyday operating discipline rather than a one-off IT task.

If your systems are compromised

Where a practice suspects a device or system has been compromised, the ATO recommends acting quickly.

Affected devices should be isolated or powered down where appropriate, and the practice should seek specialist cyber security or IT assistance.

If client identity information may have been affected, the ATO's Client Identity Support Centre can also assist.

IDCARE is another support service available to individuals and organisations affected by identity or cyber incidents.

The precise response will depend on the nature of the compromise, but speed matters because continued access can increase the scale of data loss.

Who may be affected

All tax practices are potential targets, from sole practitioners to larger accounting firms.

Practices that routinely receive unsolicited emails or attachments may face particular exposure because attackers can disguise malicious files as ordinary business communications.

Job applications, invoices, client documents and file-sharing links can all be used as delivery mechanisms.

The risk is therefore not limited to highly technical attacks.

Often, the first point of compromise is simply a staff member opening a convincing-looking attachment or clicking a malicious link.

What to consider next

Tax practices should review their cyber security controls now rather than waiting for an incident.

Key questions include:

  • Is multi-factor authentication enabled everywhere it can be?
  • Are operating systems and applications fully patched?
  • Are staff trained to recognise suspicious emails and attachments?
  • Are backups current, separated from production systems and regularly tested?
  • Are unusual login attempts or account changes monitored?
  • Does the practice know who to contact immediately if a breach occurs?

A short review of these basics can significantly reduce the risk of a successful attack.

Why tax practices are a target

Tax practices are attractive to cyber criminals because of the quality and concentration of the information they hold.

Client tax file numbers, identity details, financial records and access to online tax services can all be valuable to attackers.

That creates the potential for fraud, Identity Theft and account Takeover if systems are compromised.

The ATO's alert followed the identification of malicious activity affecting a small number of tax professional systems, including attacks delivered through links embedded in emails and documents.

The fact that the ATO's own systems were not compromised is an important distinction. The issue was with compromised practitioner environments rather than a breach of ATO infrastructure.

Building resilient defences

Strong cyber security is less about one product and more about layers of protection.

Multi-factor authentication helps reduce the risk that a stolen password alone can be used to access an account.

Software updates reduce exposure to known vulnerabilities.

Antivirus and endpoint protection can help identify malicious files.

Backups provide a recovery path if ransomware or destructive malware affects systems.

Staff awareness is equally important because many attacks depend on social engineering rather than purely technical exploitation.

Every person in a practice who receives email or opens attachments should understand how to recognise suspicious communications.

Staff awareness matters

Cyber security Training should not be limited to partners, senior staff or IT teams.

Attackers often target whoever is most likely to respond to a believable message.

That might be a receptionist, junior accountant, Payroll administrator or someone reviewing job applications.

Simple habits can reduce risk:

  • pause before opening unexpected attachments;
  • verify unusual requests through a second channel;
  • never rely solely on the sender name shown in an email;
  • report suspicious messages internally; and
  • avoid entering credentials after following an unexpected link.

The more quickly suspicious activity is reported, the greater the chance of containing it before it spreads.