CE Catalog|
IRS Written Information Security Plan (WISP), FTC GLBA Safeguards & IRC §7216 Annual Staff Security Course
IRS Written Information Security Plan (WISP), FTC GLBA Safeguards & IRC §7216 Annual Staff Security Course
Follows Managing Tax Partner Diane Mercer, EA, CPA and Designated Qualified Individual Amir Patel, CISA at Oakridge Tax & Wealth Advisors (a 19-person CPA/EA/RIA practice) after a spear-phishing remote-access trojan compromises a seasonal preparer’s unmanaged home laptop in February—exposing 640 unencrypted Form 1040 PDFs, an unauthorized offshore workpaper upload, and 18 fraudulent e-filed refunds under the firm’s EFIN while their Form W-12 PTIN attestation claimed an active WISP was in place.
IRS Form W-12 Attestation, Publication 5708 & FTC GLBA Safeguards Rule (16 CFR Part 314) Mandatory Controls
The chill of February still clung to the air, but a colder dread settled over Diane Mercer, EA, CPA, Managing Tax Partner at Oakridge Tax & Wealth Advisors. Her firm's EFIN had been used to e-file 18 fraudulent Form 1040 refunds, totaling $72,000. The breach originated from a spear-phishing attack that compromised seasonal preparer Mark Johnson's unmanaged home laptop. This single point of failure exposed 640 unencrypted Form 1040 PDFs, containing sensitive taxpayer data, and revealed an unauthorized offshore workpaper upload to a third-party cloud storage service. The firm's Form W-12 PTIN attestation, submitted just weeks prior, claimed an active Written Information Security Plan (WISP) was in place, a claim now under severe scrutiny.