Tax-MT, a tax preparation and accounting firm in Billings, Montana, has sent a notice about a recent data security incident that may have involved personal information. This page summarizes what the notice and the Massachusetts breach report say so far.
Tax-MT’s Data Breach Investigation
Tax-MT PLLC, which does business as Tax-MT, is a locally owned tax and accounting firm in Billings, Montana. Its website describes a team of CPAs, certified tax professionals and support staff who provide accounting, tax preparation, payroll, bookkeeping and consulting services to individuals and businesses. The firm has told people that a recent data security incident may have involved their personal information. Its notice letter is dated October 20, 2026, and a sample was filed with the Massachusetts Office of Consumer Affairs and Business Regulation and posted on the state’s website.
The state’s 2026 breach report lists the filing as reported on October 20, 2026, and shows 3 Massachusetts residents affected. It classifies the firm as a financial services company and flags Social Security numbers as breached. It does not flag medical records, financial account information, driver’s license numbers or credit and debit card numbers. Those flags come from the state’s summary and not from the text of the letter, so each recipient should check their own notice for what applies to them.
The letter says very little about the incident itself. It does not describe what happened, when the firm found out, when any unauthorized activity began or ended, or whether the cause was an outside attack, a mistake or the loss of a device. It states only that the incident may have involved the recipient’s personal information, and it directs people to resources for protecting it. The firm has not published a timeline of the underlying event.
No total number of affected people has been published. The figure of 3 covers only Massachusetts residents. A tax preparation firm in Montana would be expected to serve clients mostly in its own region, so many more people may have received notices elsewhere, but the firm has not said how many clients, employees or other people were notified.
To respond, the firm is offering complimentary credit monitoring and identity protection through Experian. The letter describes 24 months of credit monitoring, a $1 million identity fraud loss reimbursement policy and fully managed identity theft recovery services. People enroll with the code in their own letter, either online or by phone, and the letter gives an enrollment deadline of January 29, 2027. A footnote explains that to receive credit monitoring a person must be over the age of 18, have established credit in the United States, have a Social Security number in their own name and have a United States residential address on their credit file.
The notice also sets out Massachusetts-specific rights. It explains that people may obtain any police report filed about the incident, and that anyone who is the victim of identity theft may file a police report and get a copy. It describes how to place a security freeze, which must be requested separately from each of the three major credit reporting agencies. The letter says the bureaus have three business days to place or lift a freeze after receiving a request and that no fee may be charged to place, lift or remove one.
Tax preparers hold some of the most complete financial profiles of any business: tax returns, Social Security numbers, bank account details, dependents’ information and income records. That concentration makes them attractive targets, and an incident can reach people who never dealt with the firm directly, such as the employees of a business client or family members listed on a return. A Social Security number can support fraudulent credit applications, false tax filings and impersonation of the victim, and the risk can last for years.
Because tax data may be involved, people who receive a notice from a tax or accounting firm may also want to consider an Identity Protection PIN from the IRS in addition to a credit freeze and fraud alert. If you received a letter from Tax-MT, keep it and the envelope. Attorneys are looking into whether the firm took reasonable steps to protect client information and whether its notice to affected people met the standards that apply.
When Did This Breach Occur?
The notice does not say when the incident happened or when Tax-MT discovered it. The letter is dated October 20, 2026, which is the date the firm began communicating with affected individuals, and the filing was reported to Massachusetts on the same date. The firm has not published a timeline of when any unauthorized access began, was detected or ended, so the timing of the underlying event should be treated as unknown for now.
What Information Was Breached?
The notice says only that personal information may have been involved. The Massachusetts breach report flags Social Security numbers as breached, and does not flag medical records, financial account information, driver’s license numbers or credit and debit card numbers. Not every person will have had the same data involved, so your own letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to Tax-MT or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of Experian credit monitoring and identity recovery offered in the letter before the January 29, 2027 deadline, using the enrollment code in your copy.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Tax-MT
If you received a notice from Tax-MT, or you believe your information was involved, you may have legal options for holding the firm accountable for how it protected your Social Security number and other sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
