TaxSlayer

Disclosed Jan 29, 20168,800 affectedSettled

Hackers took over nearly 9,000 TaxSlayer accounts to file fraudulent returns

The FTC said malicious hackers gained full access to nearly 9,000 TaxSlayer accounts between October and December 2015 and used them for tax identity theft, filing fraudulent returns to obtain refunds. TaxSlayer settled charges it violated the GLBA Safeguards and Privacy Rules.

What is known

People affected	8,800 (as reported by the organization)
Disclosed	Jan 29, 2016
Happened	Oct 10, 2015
Attack	Credential stuffing
Data exposed	NamesSocial Security numbersFinancialCredentials and tokensGovernment IDsPayment cardsPasswords
Sector	Finance · US
Status	Settled
Lawsuit or fine	FTC consent order (2017)

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: TaxSlayer

Newsen.wikipedia.org

List of data breaches - Wikipedia

Regulatorftc.gov

Operator of Online Tax Preparation Service Agrees to Settle FTC Charges

Official noticemaine.gov

Maine Attorney General breach notice archive: TaxSlayer

Notices filed

Residents of CAJan 29, 2016

California AGCount not stated

Residents of MEJan 29, 2016

Maine AG35 people

TotalFeb 4, 2016

Research8,800 people

History of this record

data_types2026-09-25

["names","ssn","financial","credentials"] to ["names","ssn","financial","credentials","government-id","payment-card","passwords"]by backfillSource

status2026-09-25

confirmed to settledby seedSource

lawsuit2026-09-25

empty to FTC consent order (2017)by seedSource

attack2026-09-25

unknown to credential-stuffingby seedSource

data_types2026-09-25

[] to ["names","ssn","financial","credentials"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 8800by seedSource

summary2026-09-25

empty to The FTC said malicious hackers gained full access to nearly 9,000 TaxSlayer accounts between October and December 2015 and used them for tax identity theft, filing fraudulent returns to obtain refunds. TaxSlayer settled charges it violated by seedSource

title2026-09-25

empty to Hackers took over nearly 9,000 TaxSlayer accounts to file fraudulent returnsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about TaxSlayer