Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Note: the CPA engagement described below is a composite drawn from FC engagements with several Ontario and British Columbia accounting firms during the 2024 and 2025 tax seasons. Identifiers have been changed to protect client confidentiality. The timeline, the regulator interactions, and the recovery numbers are real.
The call came on a Tuesday in late March, eleven days before the T1 filing deadline. The managing partner of a fourteen-person CPA firm in the Greater Toronto Area was on the phone. His voice had the particular quality of someone who has just realised he cannot file a single return today.
His CaseWare files were unreachable. The EFILE workstation showed a connection error he had never seen. The receptionist had taken three calls in twenty minutes from clients who could not upload slips.
I picked up that call. The first fifteen minutes were not about the ransomware. They were about stopping the next thirty staff actions from making the PIPEDA and CRA exposure worse.
By 11:40 we had an isolation instruction, a paper-only intake process, and a call placed to the firm’s cyber insurer. By 1:15 the EFILE Help Desk had been notified.
I am an MSP, not a lawyer and not a CPA. What follows is the operational half of a tax-season playbook, written from inside that engagement and from the half-dozen Canadian CPA incidents I have led since 2022.
Key Takeaways
- The first decision in the first ten minutes is isolate, do not power off. Memory-resident evidence and the EFILE session token both matter to the regulator stack that runs next.
- The Canadian notification stack runs five clocks in parallel: PIPEDA, FINTRAC where AML-engaged, the CRA EFILE Help Desk, the provincial CPA body, and the cyber insurer.
- PIPEDA has no 72-hour deadline. Section 10.1 requires a report as soon as feasible after the firm determines the breach occurred. Breach records are kept 24 months from that determination.
- Ransomware operators do not single out accounting firms. The Cyber Centre judges them opportunistic. The tax-season risk is your own concentration of urgency, not a targeting decision.
- Backup-first recovery without paying ransom is achievable for a 10-to-25-seat firm inside 72 hours when immutable offline backups exist and have been verified.
This piece sits inside the longer Canadian CPA firm AI and cybersecurity playbook. It assumes you accept that your tax-prep software, your portal vendor and your scanner appliance are in scope when an attacker reaches your network.
Why Tax Season Is the Worst Possible Time for a Ransomware Attack on a CPA Firm.
According to the Canadian Centre for Cyber Security (2024), ransomware will almost certainly remain the most impactful cyber threat facing Canadian organisations. The same assessment recorded a 112% rise in Canadian professional-services ransomware incidents between 2022 and 2023, the fourth-steepest jump of any sector it tracks.
The partner asked me on day two why he was hit on March 19 rather than November 19. My answer had three parts, none involving anyone picking his firm off a list.
- Economic. Ransom pricing tracks operational urgency. A CPA firm cannot tell clients in writing that it will not be filing returns this April, and that pressure is readable off your own file server.
- Operational. Every staff member is at maximum load, partners review files at 11pm, and the office manager opens attachments from clients she has never met. Social-engineering exposure peaks.
- Infrastructural. This firm’s VPN had run three years without an MFA rebuild. The EFILE workstation sat on the receptionist’s flat network. None of that was defensible in November either.
The Three Weeks Before T1 Deadline: What an Attacker Sees in a Canadian CPA Pipeline.
According to the Verizon Data Breach Investigations Report (2026), exploitation of vulnerabilities has become the most common initial access vector at 31% of breaches, while credential abuse has fallen to 13%. That inverts the pattern most accounting-firm guidance still assumes, and it moves the priority to patching your edge.
The composite firm had exactly the topology that makes a tax-season incident expensive. I sketched all 5 pieces of it on the back of an engagement letter while we waited for forensics.
| What the firm had. | Why it mattered on March 19. |
|---|---|
| One file server in a back-office closet. | Single blast radius for the whole engagement directory. |
| EFILE workstation used personally by the senior partner. | The registrant of record could not transmit a single return. |
| Scanner appliance emailing scans into a shared mailbox. | Client slips with SIN data sat unclassified in mail. |
| Three domain-joined partner laptops taken home. | Cached credentials extended the attack surface off-site. |
| A USB backup drive permanently mounted to the server. | Encrypted alongside production. Not a backup. |
The attacker entered through the VPN and sat on the network roughly eleven days before encryption fired on March 19. That timeline is the forensic reconstruction three weeks later, not what the firm understood that morning.
Inside those 11 days the attacker walked the file server, found the engagement directory, found the partners’ tax-planning workbooks, and found that mounted USB drive. The pipeline an attacker reads is your tax-engagement workflow rather than your accounting software.
The First 60 Minutes of an EFILE Outage During Tax Season: the response checklist.
According to CRA EFILE eligibility guidance (2026), electronic filers must keep their EFILE number and password confidential and must report any loss or suspected loss of client information immediately. CRA reserves the right to revoke authorisation where a filer fails to do so.
Read that consequence carefully, because it is stronger than most firms assume. The Canada Revenue Agency usually sends a warning letter first, then adds that a filer “could be suspended immediately, without warning and without possibility of reinstatement”. No duration is published.
I told the senior partner at 11:18am that his EFILE authorisation was at risk if we did not move within thirty minutes. He believed me once I read him the CRA filing-security page (2026) off my laptop, the only working machine in the building.
The decision tree for the first hour is simple. It is just 4 decisions most Canadian CPA firms have never written down.
- Minutes 0 to 5. Isolate every workstation by unplugging Ethernet and disabling Wi-Fi. Do not power down. Do not reboot. Do not log in to the EFILE workstation to check whether it still works.
- Minutes 5 to 15. Call the MSP first. With no MSP, call the cyber-insurance hotline. The EFILE Help Desk is the third call, because you need a containment instruction before the regulator conversation opens.
- Minutes 15 to 30. Capture volatile memory from one workstation if equipment is on-site. The senior partner places the Help Desk call and records the reference number.
- Minutes 30 to 60. Decide whether to close the office. For a fourteen-person firm in mid-March the answer is almost always yes. Send staff home with written limits on personal-device use.
He asked me at 11:42 whether he should email clients. I said no. The cyber insurer’s legal panel writes that script and the firm’s privacy lawyer reviews it. The partner does not draft it on a phone in the parking lot.
[FIELD NOTE] The four-hour email that cost 60 extra days.
At a 22-seat CPA firm in the western Greater Toronto Area last spring, the managing partner emailed all 380 client households within four hours of encryption, before the insurer’s legal panel had drafted anything. The email used the word “hack” six times.
My read on what it cost: the firm spent 90 days inside a regulator conversation that should have taken 30. The insurer then disputed the legal-defence line, because admissions had been made outside the approved channel. The honest answer in hour two is that you are working on it and will write with specifics inside 72 hours.
Mike Pearlstein, CISSP, Fusion Computing. Anonymized client data; city, sector and size band only.
Want an EFILE-outage first-hour checklist you can tape inside the supply closet? Get in touch →
PIPEDA, FINTRAC, and CRA EFILE: The Three-Regulator Notification Stack, explained.
According to the Office of the Privacy Commissioner of Canada (2018), a firm subject to PIPEDA must report a breach where a real risk of significant harm exists. It must also notify affected individuals, and keep a record of every breach whether or not it was reportable.
Now the correction that matters most, because I hear it wrong in nearly every partner meeting. PIPEDA section 10.1 (2026) requires the report as soon as feasible after the organization determines that the breach has occurred. There is no 72-hour clock in the statute.
The 72-hour figure is imported from the European GDPR and repeated until it sounds Canadian. Your genuine 72-hour deadlines are contractual, and they come from your cyber insurer rather than any regulator.
The record-keeping obligation does carry a fixed number. Under the Breach of Security Safeguards Regulations (2018), section 6(1) requires a record of every breach for 24 months after determination. That clock starts at determination, not encryption.
For a firm holding T1 data, the real-risk threshold is almost always met where records include Social Insurance Numbers or direct-deposit details. That determination is a legal call and belongs with your privacy counsel.
The FINTRAC clock applies where the firm engages in activity covered by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Firms doing trust-account or real-estate settlement work are reporting entities, and our companion guide on FINTRAC IT controls for Canadian accountants covers that control set.
The CRA EFILE and CPA conduct clocks running in parallel.
- The EFILE clock is the one firms forget. It is a service arrangement with the Canada Revenue Agency rather than a public-law regime, and the consequence of mishandling it lands just as hard. The Help Desk call documented in hour one is what protects the authorisation.
- The CPA conduct clock is the most expensive to misjudge. CPA Ontario, CPA Alberta, CPA British Columbia and the other provincial bodies treat confidentiality breaches as conduct matters, and your response posture becomes evidence in any review.
| Clock. | Trigger. | Timing. |
|---|---|---|
| PIPEDA. | Real risk of significant harm determined. | As soon as feasible. Records kept 24 months. |
| FINTRAC. | Firm is a reporting entity under PCMLTFA. | Per the firm’s own compliance program. |
| CRA EFILE. | Suspected loss of the number or client data. | Immediately. Hour one in practice. |
| Provincial CPA body. | Client confidentiality breach. | Per provincial rules. Take counsel early. |
| Cyber insurer. | Any material incident. | Per policy. Commonly 24 to 72 hours. |
Want the five-clock stack mapped to named owners inside your firm? Talk to our team →
Recovery Without Paying Ransom: The Backup-First Protocol and What It Requires.
According to Canadian Centre for Cyber Security guidance (2024), paying a ransom is not recommended. Payment does not guarantee key recovery, does not stop a double-extortion leak, may create sanctions exposure, and marks the firm as willing to pay again.
The composite firm had immutable offline backups. That single fact is the whole difference between the two stories below.
A nightly snapshot ran to an off-site immutable repository. Immutable means the volume cannot be modified or deleted for a hardcoded window, including by a Microsoft 365 administrator account the attacker already controls.
- Hour eight. Forensics confirmed the encryption had not reached the immutable repository.
- Hour fourteen. We stood up a clean replacement server, restored the previous night’s snapshot, and began reissuing credentials.
- Hour fifty-two. The firm was filing T1 returns again from a rebuilt EFILE workstation.
- CA$204,000 all-in. The total cost of the incident.
- CA$138,000 covered. Forensics, legal panel, credit monitoring, after-hours labour.
- CA$66,000 absorbed. Deductible plus the infrastructure spend the insurer declined.
“The forty-eight hours after Fusion got involved felt nothing like the four hours before. We had a written sequence of who we were going to call, in what order, and with what script. Without that document the partners would have spent the week arguing about ransom math instead of filing 280 T1 returns by deadline.”
The firm without immutable backups follows a different path. Partners open negotiations by hour 12, pay inside the first day, wait up to 72 hours for keys, and then find a meaningful share of files do not decrypt cleanly.
That recovery stretches to 9 or 17 days. The firm misses the T1 deadline, clients who can refile elsewhere do, and the rest file extensions carrying problems nobody caught.
What Goes Into an IRP That Survives March and April: a plain-English overview.
According to Statistics Canada (2024), 16% of Canadian businesses were impacted by cyber security incidents in 2023, and large businesses remained the most likely to be hit at 30%. The survey covers firms with 10 or more employees, so most small practices sit below its floor entirely.
That detail is worth sitting with. The Statistics Canada figures under-represent exactly the size of firm reading this, which is one reason partner groups decide they are too small to interest anyone.
Across our small and mid-sized Canadian CPA firm clients, only a minority hold a documented and tested incident response plan, and those that do recover measurably faster. In our experience the written plan is what converts a panicked Tuesday into a sequenced response.
I have built and tested plans for accounting clients from 6-seat sole practitioners to 75-seat regional firms. What works is not the generic NIST 800-61 template from a vendor blog. It is shorter, tied to the tax-season calendar, and honest about what partners do at 7am in March.
The five pages I will sign off on are these.
- Page one. The phone tree. Who calls whom, in what order, with after-hours numbers. MSP or insurer hotline first depending on coverage. Partner mobiles, the privacy lawyer, the CPA body contact, the broker.
- Page two. The first-60-minute checklist. Isolate, do not power off. Do not log in to EFILE. Do not email clients. Capture observation notes from the moment of detection. Place the Help Desk call inside hour one and record the reference number.
- Page three. The five-clock stack. PIPEDA, FINTRAC, CRA EFILE, provincial CPA body, cyber insurer. The named owner of each clock, its timing, and the documentation it needs.
- Page four. The recovery sequence. Backup verification, clean-image rebuild, credential reset, MFA on every login, the order workstations return, and partner sign-off at each step.
- Page five. The client-communication script. Drafted by the privacy lawyer in advance, reviewed annually, stored somewhere that is not the firm’s primary mailbox. What to say at 24 hours, 72 hours, seven days, and 30 days.
The highest-impact item on those 5 pages is the tabletop exercise. A 2-hour drill against a written scenario surfaces most of the gaps before they cost anything.
I run these drills with our accounting clients each September. They cost less than one billable partner half-day, and they are the most useful document a firm can put in front of a cyber insurer at renewal.
For the hardening layer underneath the plan, the sibling spokes carry the detail.
- CRA EFILE security for Canadian accounting firms.
- CCH iFirm and CaseWare hardening, covering MFA bypass windows and audit-trail limits inside the two tenants.
- Accounting firm data security in Canada, which reads CPA Ontario Rule 208.3 against outsourced IT access.
- Buyer guide to IT providers for Canadian accounting firms, if the plan still needs an owner.
Five things decide whether a Canadian CPA firm comes through a tax-season incident intact.
- Immutable offline backups verified inside 90 days.
- A five-page plan tested inside 12 months.
- A named MSP contact with after-hours EFILE knowledge.
- A policy with a 24/7 hotline and the declarations page printed.
- A settled partner decision on ransom authority.
Bottom Line: what is worth doing before March.
A 14-seat Canadian CPA firm can survive tax-season ransomware without paying, without losing engagement files, and without missing the T1 deadline for most of its client list. Most Canadian firms under 30 seats currently hold fewer than three of those five.
The right week to fix it is in September. Our cybersecurity services hub covers the wider programme.
FAQ.
Does PIPEDA give a Canadian CPA firm 72 hours to report a breach?
No. PIPEDA section 10.1 requires the report as soon as feasible after the firm determines the breach occurred, and no 72-hour deadline appears in the statute. That figure is imported from the European GDPR. Real 72-hour deadlines for a CPA firm are contractual and come from the cyber insurance policy.
How long must we keep breach records?
24 months. The Breach of Security Safeguards Regulations section 6(1) requires a record of every breach for 24 months after the day the organisation determines the breach occurred. That covers breaches you assess as below the real-risk threshold, and the clock runs from determination rather than the incident.
Should I notify CRA EFILE if my workstation is compromised during tax season?
Yes, inside hour 1. CRA requires filers to keep the EFILE number and password confidential and to report any suspected loss of client information immediately. CRA can revoke authorisation for failing to do so, and states a filer could be suspended immediately, without warning and without possibility of reinstatement.
Do ransomware operators deliberately target accounting firms at tax time?
The Canadian Centre for Cyber Security judges operators almost certainly opportunistic, choosing victims by opportunity rather than industry. What changes in March is your own exposure: 40 or more new engagements, peak staff load, zero tolerance for downtime. Canadian professional-services incidents did rise 112% between 2022 and 2023.
Should a CPA firm pay the ransom during tax season?
Cyber Centre guidance recommends against payment. It does not guarantee key recovery, does not stop a double-extortion leak, may create sanctions exposure, and marks the firm as willing to pay again. With immutable backups verified inside 90 days, recovery without payment is typically achievable inside 72 hours.
How much does a tax-season ransomware incident cost a Canadian CPA firm?
In the engagement described here the all-in cost was approximately CA$204,000, of which roughly CA$138,000 was covered by cyber insurance and CA$66,000 absorbed by the firm. Costs without immutable backups run far higher, driven by extended downtime and client refiling during a 9 to 17 day recovery.
Should I email my clients in the first few hours after a ransomware event?
No. The cyber insurer legal panel writes the client-communication script and the firm privacy lawyer reviews it before anything goes out. Premature notification can turn a containable incident into a PIPEDA real-risk determination problem and a conduct file in the same week.
What is the single most useful thing a managing partner can do in September?
Book a two-hour tabletop exercise with the privacy lawyer, the MSP and the EFILE registrant of record, running an 11am Tuesday encryption scenario in mid-March. Surface the gaps in the phone tree, the five-clock stack and the client script before they cost anything. Tested in the last 12 months is what most Canadian insurers now ask at renewal.
