We have frequently reported about how devastating and widespread tax fraud is in the U.S.—in the past affecting hundreds of thousands of U.S. taxpayers [view related privacy tip]. Income tax preparers are at risk for cyber intrusions because they hold highly sensitive personal information of their clients, which can be used by criminals to commit tax fraud and identity theft.

Virginia became the first state in the nation to amend its data breach law to specifically require signing income tax preparers to notify the Virginia Department of Taxation if they discover or are notified of a breach of taxpayer information, including “return information,” which covers all of the information found on a tax return.

Tax preparers are required to provide notice to the Department without unreasonable delay. We expect that other states will follow Virginia’s requirement due to the highly sensitive nature of the personal information held by income tax preparers, and the consequences to taxpayers in the event of a cyber intrusion and theft of the tax information of individuals.