Langwasser & Company CPAs Data Breach

Langwasser & Company CPAs, an accounting and tax preparation firm based in Upland, California, has notified clients of a security incident after learning that unauthorized tax returns were filed using information the firm maintained on their behalf. Because tax preparers routinely hold some of the most sensitive financial and identifying information their clients possess, an incident like this raises real concerns even before every detail is confirmed, and companies entrusted with that data carry a corresponding responsibility to safeguard it and to be transparent when something goes wrong.

Langwasser & Company CPAs’s Data Breach Investigation

According to a notification letter filed with the California Attorney General, Langwasser & Company CPAs learned on or around May 5, 2026 that a limited number of unauthorized tax returns had been filed using client information the firm maintained. The firm states that clients directly affected by the fraudulent filings have already been contacted individually. Upon discovering the issue, Langwasser & Company CPAs immediately notified the Internal Revenue Service and began working with outside cybersecurity professionals experienced in handling this type of incident to investigate further.

Following that investigation and an extensive review of the firm’s files, Langwasser & Company CPAs determined that an unauthorized actor may have had access to additional personal information beyond what was used in the fraudulent filings themselves, though the firm’s cybersecurity specialists were unable to confirm the full extent of what was actually accessed or acquired. That kind of uncertainty is common in the early aftermath of a security incident, particularly one involving unauthorized tax filings, where investigators must reconstruct what happened after the fact using system logs and forensic evidence rather than a complete real-time record of every file an intruder touched.

Accounting and tax-preparation firms are attractive targets for cybercriminals precisely because of what they store: Social Security numbers, dates of birth, bank account and routing numbers, prior-year tax returns, and other information that can be used to file fraudulent returns, open new lines of credit, or otherwise commit identity theft. An unauthorized tax return filing, as described in this incident, is itself one of the more direct and immediate ways that stolen identifying information gets monetized, since a fraudulent refund can sometimes be claimed before the legitimate taxpayer ever files their own return. This is also why the IRS maintains dedicated processes, including the Identity Protection PIN program, specifically to help taxpayers who have been affected by this kind of fraud.

Notification timelines for incidents like this one often unfold in stages: an initial letter goes out once a firm has confirmed that at least some clients were affected and has a baseline understanding of what occurred, even while the deeper forensic investigation into the full scope of accessed data continues in parallel. Clients who receive an initial notice should not assume the situation is fully resolved or fully understood at the time the letter arrives, and should take the recommended precautions seriously even if the letter does not yet specify every detail of what was exposed.

When Did This Breach Occur?

Langwasser & Company CPAs states that it learned of the unauthorized tax return filings on or around May 5, 2026. The firm has not publicly disclosed additional detail about when any unauthorized access to its systems may have first begun or how long it may have gone undetected before discovery. Affected clients were notified beginning around the same period after the firm completed its initial investigation and engaged outside cybersecurity assistance.

What Information Was Breached?

Langwasser & Company CPAs has stated that its cybersecurity specialists were unable to confirm the full extent of the information an unauthorized actor may have accessed. The firm’s notification letter indicates that the files at issue included each recipient’s name in combination with certain other personal data elements specific to that individual, without publicly specifying a single universal list of data types for all affected clients. Because the firm is a tax preparation and accounting practice, the types of information it typically maintains for clients can include Social Security numbers, dates of birth, and financial account details, though Langwasser & Company CPAs has not confirmed that these specific categories were involved in this particular incident.

What You Can Do

• Enroll in the complimentary Experian IdentityWorks membership offered in the notification letter.
• Consider applying for an IRS Identity Protection PIN, which can help prevent fraudulent tax filings in your name going forward.
• Place a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion.
• Request a free credit report from each of the three major credit bureaus and review it for unfamiliar accounts or inquiries.
• Monitor your accounts and any IRS correspondence closely for signs of continued fraudulent activity.

File a Data Breach Lawsuit Against Langwasser & Company CPAs

If you received a notice from Langwasser & Company CPAs about this incident, or if you have discovered that a fraudulent tax return was filed in your name, you may have legal options available to you.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.