Were you recently affected by a data breach?
Dole Accounting Services, an Enfield, New Hampshire tax preparer, reported on October 22, 2026 that fraudulent tax returns filed with its e-file credentials may have exposed Social Security numbers of 12 people.
Who was affected:
Impacted Data:
Social Security numbers
Dole Accounting Services, a tax preparation firm in Enfield, New Hampshire, has notified the New Hampshire Attorney General of a cybersecurity event. Tax preparers hold some of the most sensitive records a person has, and they are expected to protect them with reasonable security.
Dole Accounting Services, Inc. is an accounting and tax preparation business located in Enfield, New Hampshire. Like any tax preparer, it collects the details people need to file returns, including names, Social Security numbers, and the Social Security numbers of dependents. Those records make a tax preparer’s systems an attractive target for criminals who want to file false returns and collect refunds in someone else’s name.
According to the firm’s notice to the New Hampshire Attorney General dated October 22, 2026, an unauthorized party filed fraudulent tax returns on or around August 24, 2026, using the firm’s Electronic Filing Identification Number, known as an EFIN. An EFIN is the credential the IRS issues to a tax preparer so that returns can be submitted electronically. The firm reported that Social Security numbers belonging to 12 individuals may have been compromised.
The notice explains that 4 returns were filed fraudulently, and that 2 of them were for New Hampshire residents. The total of 12 people includes dependents who were listed on those 4 returns, which is why the number of affected individuals is larger than the number of returns. The notice does not describe how the unauthorized party obtained the credentials or the taxpayer information used to prepare the returns.
The firm says it learned of the activity on September 7, 2026. It then took steps to secure the systems involved, engaged cybersecurity professionals to investigate the scope of the incident, and reported the matter to the IRS Stakeholder Liaison. The computer that was affected was wiped and restored to factory settings, and programs and data files were reinstalled from a clean backup. The firm also said it has taken, and will continue to take, steps to improve the security of its network.
On September 9, 2026, the firm sent notifications by email to the taxpayers on all 4 fraudulent returns, including the New Hampshire residents. The sample email enclosed with the state filing told the recipient that a federal return had been filed that the firm had not finalized, and explained that the person would likely receive a notice from the IRS. It encouraged recipients to complete IRS Form 14039, the Identity Theft Affidavit, and to request an IRS Identity Protection PIN, a number that must be used to file a return electronically in future years.
Fraudulent tax filings are a different kind of harm from a typical data breach. When a criminal files a return using a stolen Social Security number, the real taxpayer may find out only when the IRS rejects their own electronic return or sends a letter about a duplicate filing. Resolving the problem can take months, and it often requires filing a paper return and submitting identity theft paperwork to the IRS. Dependents can be affected too, even though they may never file a return themselves for years.
A Social Security number is also useful well beyond tax fraud. Combined with a name and a date of birth, it can be used to open credit accounts, apply for loans, or make convincing impersonation attempts. Unlike a password, it generally cannot be replaced, so the risk from an exposure can last for years. This is why privacy advocates and regulators encourage anyone told that their number may have been misused to consider a credit freeze and to review their credit reports regularly.
State breach notification laws generally require an organization to tell affected people, and in many states the attorney general, when personal information may have been acquired without authorization. These notices usually describe what happened, what information was involved, and what steps the organization has taken. Accountants and tax preparers are a recurring subject of such notices because they combine identity data for many households in one place, and many are small businesses with limited security resources.
Attorneys are looking into whether Dole Accounting Services maintained reasonable safeguards for the sensitive tax and identity information it held, including how its e-file credentials and client records were protected and monitored, and whether stronger controls could have prevented the fraudulent filings. If you are a client of the firm, or if you received an email or letter about this incident, keep it, because it can help document when you were notified and what the firm told you.
The firm’s notice states that the fraudulent returns were filed on or around August 24, 2026, and that the firm learned of the activity on September 7, 2026. It emailed the affected taxpayers on September 9, 2026, and sent its notice to the New Hampshire Attorney General on October 22, 2026. The notice does not say how the unauthorized party gained the access it used, or whether any other filing activity occurred before August 24, 2026.
The firm reports that Social Security numbers may have been compromised for 12 individuals, including dependents listed on the 4 fraudulent returns. The notice does not list any other categories of information, such as bank account numbers, and it does not say whether the unauthorized party saw more client records than those used to prepare the returns. This page will be updated if the firm or a regulator provides more information.
If you received a notice related to Dole Accounting Services or believe you may be affected, consider these steps:
If you are a client of Dole Accounting Services, were listed as a dependent on a return it prepared, or received a notice about this incident, you may have legal options for holding the firm accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
A data breach occurs when sensitive, confidential, or protected information is accessed, stolen, or disclosed without authorization. Data breaches often occur through phishing emails, malware, weak passwords, insider threats, or unsecured databases. Indicators of a data breach can include unexpected password resets, suspicious account activity, unauthorized transactions, or notifications from companies about compromised information.If you suspect your data has been compromised, you must take measures and act quickly. Change passwords, enable two-factor authentication, review your financial accounts for unusual activity and consider freezing your credit.
Once stolen, your personal information may be sold on the dark web or used for identity theft and financial fraud. In some cases, hackers use the data to extort companies or launch further attacks. Victims often face long-term risks, including damage to credit and privacy.
If you receive a data breach notification, don’t ignore it. Immediately change passwords for the affected account and any others that share credentials. Enroll in any free credit monitoring services offered and monitor financial statements closely.
To pursue a data breach claim, you’ll need documentation showing your information was compromised and proof of resulting harm, such as fraudulent charges, credit score damage, or identity theft reports. Notification letters, financial records, and communication with the breached company can help support your claim.
Yes. If a company fails to protect consumer data or delays notifying victims, it may be held liable under state and federal privacy laws. Many victims join class action lawsuits to recover financial losses and hold negligent organizations accountable.
Data breach settlements vary widely depending on the size of the breach, type of data compromised, and damages suffered by victims. Payouts may include cash compensation, identity theft protection, or reimbursement for losses. Many settlements range from a few hundred to several thousand dollars per person. A skilled data breach lawyer can guide victims through the complex legal process, ensuring their rights are protected. If you’ve received a data breach notification or believe your personal data was exposed, you may be eligible for compensation. Contact Class Action U to learn more about how to join a data breach lawsuit and understand the process of filing.
