2026 TaxAct — unauthenticated API claim; ~2M records acquired, 450k leaked (unverified)
Data compromised
Source claimed more than 2 million client records (phone numbers, usernames, emails); ~450,000 records later appeared on a Russian-language forum. Not all phones real per source. Company had not attested a census — labeled unverified.
Technical writeup
Unverified API / forum-leak claim — August 17, 2026 DataBreaches.net. An anonymous Signal source said they acquired more than 2 million TaxAct (Taxwell / Cinven) client records with phones, usernames, and emails via unauthenticated or easily exploitable API endpoints (“know a URL”). Source provided a 25,000-row sample and said TaxAct staff replied then went silent after 10 August. DataBreaches could not obtain a public company statement; some usernames/emails in samples matched phones. About 450,000 records were posted on a Russian-language forum. BreachHistory indexes companyConfirmed false; recordsAffected 2000000 as the source-claimed acquired count, with 450k leaked noted in prose. Distinct from the confirmed French DGFiP tax-authority incident.
Root cause
Unverified source report of unauthenticated/easily exploitable TaxAct API infrastructure returning phones, usernames, and emails; TaxAct had not issued a public confirmation at indexing