Ransomware Attack Targets Optima Tax Relief, Exposes 69GB of Client Data

Ransomware Attack Targets Optima Tax Relief, Exposes 69GB of Client Data

In today’s digital landscape, cyberattacks on financial service providers are alarmingly frequent. Major players in the tax preparation and accounting sectors have increasingly fallen victim to sophisticated ransomware attacks. These breaches not only disrupt daily operations but also put sensitive financial data at risk, potentially facilitating identity theft, fraud, and significant harm to a company’s reputation.

Recently, Optima Tax Relief, one of the leading tax resolution firms in the United States, was compromised by a ransomware group known as Chaos. This group has claimed responsibility for breaching Optima’s security, making off with an alarming 69 GB of data prior to triggering encryption of the company’s internal servers.

The information stolen includes corporate documents and sensitive client case files. For cybercriminals, tax documents are particularly enticing, as they often contain crucial details such as Social Security numbers, home addresses, and other identifiers that can be exploited for financial fraud or identity theft.

Details of the Breach

Insiders privy to the incident explained to sources that the attack was a double-extortion scheme. This means that Chaos not only stole Optima’s data but also encrypted its systems, presumably demanding a ransom for restoration of access and the promise of non-disclosure. As of now, the firm has not indicated whether it intends to comply with the ransom demand or if it will inform the customers affected by this data breach.

Earlier this week, the attackers added Optima to their leak site, raising suspicions about compliance with regulations and consumer protection standards, especially considering the sensitive nature of services provided by the firm.

Optima’s Response

To date, Optima Tax Relief has not made any official comments regarding the breach. There is also no public acknowledgment of whether law enforcement or federal agencies are involved in the ongoing investigation. Clients of Optima should consider their data to be at risk if they have utilized the firm’s services.

Attempts to reach Optima for comment have gone unanswered, leaving the public in the dark regarding the unfolding situation.

Understanding Chaos Ransomware

The Chaos ransomware first appeared on the cybersecurity scene in March 2025, when it was linked to multiple breaches. Notably, this group is separate from the