Loading story…
An anonymous individual told DataBreaches via Signal that they had acquired more than 2 million TaxAct user records and that 450,000 records had already been leaked. The allegedly exposed information reportedly includes phone numbers, usernames, and email addresses tied to TaxAct users, although the source indicated that not all phone numbers in the dataset were real.
The reports identify TaxAct as operating under parent company Taxwell, which is owned by Cinven, but they do not indicate that the company has confirmed a breach. At this stage, the incident remains an unverified claim of data acquisition and leakage, with public reporting focused on the scale of the alleged dataset and the partial release of records.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
On August 17, 2026, DataBreaches published a report describing the anonymous allegations involving TaxAct user records. The report framed the matter as an unconfirmed claim rather than a confirmed breach announcement by TaxAct.
DataBreaches reported that on August 13 it was contacted via Signal by an anonymous individual claiming to have acquired more than 2 million TaxAct user records, including phone numbers, usernames, and email addresses. The source also claimed that 450,000 of those records had already been leaked and that some phone numbers in the dataset were not real.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026
Customer data tied to **Central Tickets** and **AT&T** surfaced on hacking forums, exposing large volumes of personally identifiable information and raising questions about how long the records had circulated before becoming public. Central Tickets data posted in September 2024 affected **723,000** unique email addresses and included names, phone numbers, IP addresses, purchase records, and passwords; the breach likely occurred months earlier. The password data was reportedly stored as **unsalted `SHA-1` hashes**, pointing to weak credential protection. A separate leaked dataset allegedly linked to **AT&T** contained **tens of millions** of records and was publicly posted after first being offered for sale in 2021. The exposed information included names, email and physical addresses, dates of birth, phone numbers, and U.S. Social Security numbers. AT&T initially said its systems had not been breached, then later acknowledged the dataset contained AT&T-specific fields and said it remained unclear whether the compromise originated inside AT&T or through a vendor; the company subsequently reset customer account passcodes.
Jun 29, 2026
Ernst & Young (EY) disclosed a data breach after attackers gained unauthorized access to a third-party IT support and ticketing platform used by EY personnel supporting tax-related client work. EY said the intruders accessed the system between **March 28 and April 12, 2026**, downloaded multiple documents, and exposed personal and financial information used for tax preparation, including data tied to some individuals’ investment holdings with EY institutional clients. The firm detected anomalous activity on **April 23**, launched an investigation with external cybersecurity experts, secured affected systems, and notified federal law enforcement. EY has not disclosed the identity of the third-party vendor, the number of affected individuals, the attack method, or any attribution to a threat actor. The company said it has not found evidence that the stolen information has been misused or that specific individuals were deliberately targeted, and began notifying affected people on **July 13**. EY also filed breach notifications with the California Attorney General and is offering eligible individuals **24 months** of Experian identity monitoring and restoration services.
Jul 27, 2026