TaxSlayer
Disclosed Jan 29, 201610 years ago8,800 affectedSettled
Hackers took over nearly 9,000 TaxSlayer accounts to file fraudulent returns
The FTC said malicious hackers gained full access to nearly 9,000 TaxSlayer accounts between October and December 2015 and used them for tax identity theft, filing fraudulent returns to obtain refunds. TaxSlayer settled charges it violated the GLBA Safeguards and Privacy Rules.
What is known
| People affected | 8,800 (as reported by the organization) |
|---|---|
| Disclosed | Jan 29, 2016 |
| Happened | Oct 10, 2015 |
| Attack | Credential stuffing |
| Data exposed | Names, Social Security numbers, Financial, Credentials and tokens, Government IDs, Payment cards, Passwords |
| Sector | Finance · US |
| Status | Settled |
| Lawsuit or fine | FTC consent order (2017) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: TaxSlayeroag.ca.gov · Official notice | Official notice |
| List of data breaches - Wikipediaen.wikipedia.org · News | News |
| Operator of Online Tax Preparation Service Agrees to Settle FTC Chargesftc.gov · Regulator | Regulator |
| Maine Attorney General breach notice archive: TaxSlayermaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jan 29, 2016 | |
| Maine AGresidents of ME | Jan 29, 2016 | 35 |
| Researchtotal | Feb 4, 2016 | 8,800 |
History of this record
- 2026-09-25 · data_types: ["names","ssn","financial","credentials"] to ["names","ssn","financial","credentials","government-id","payment-card","passwords"] · backfill source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · lawsuit: empty to FTC consent order (2017) · seed source
- 2026-09-25 · attack: unknown to credential-stuffing · seed source
- 2026-09-25 · data_types: [] to ["names","ssn","financial","credentials"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 8800 · seed source
- 2026-09-25 · summary: empty to The FTC said malicious hackers gained full access to nearly 9,000 TaxSlayer accounts between October and December 2015 and used them for tax identity theft, filing fraudulent returns to obtain refunds. TaxSlayer settled charges it violated · seed source
- 2026-09-25 · title: empty to Hackers took over nearly 9,000 TaxSlayer accounts to file fraudulent returns · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.