Ransomware protection for accounting firms, layer by layer

Ransomware protection for accounting firms comes in layers: close the doors attackers use (phishing, exposed remote desktop, unpatched software), keep at least one backup copy that the office network cannot reach, test a restore before January, and write down who does what in the first hour. No single setting is enough on its own.

How does ransomware reach an accounting firm?

Ransomware reaches an accounting firm through four common doors: a phishing email with a malicious file or link, a remote desktop connection left open to the internet, software that has not been patched, and a vendor or remote-support account that attackers have taken over. Each door has its own fix: training, patching, closed remote access and vendor account checks.

Ransomware is malware that locks files until a ransom is paid. IRS Publication 4557 (Rev. 6-2024) defines it as software "designed to block access to a computer system until a ransom is paid" and says it "is typically spread through phishing emails or by unknowingly visiting an infected website."

The FBI's public service announcement High-Impact Ransomware Attacks Threaten U.S. Businesses and Organizations (I-100219-PSA, October 2, 2019) names three infection routes it has observed:

• Email phishing campaigns. "The cyber criminal sends an email containing a malicious file or link, which deploys malware when clicked by a recipient."
• Remote Desktop Protocol vulnerabilities. Attackers guess passwords or buy stolen ones "to gain unauthorized RDP access to victim systems."
• Software vulnerabilities. The same notice describes criminals exploiting "vulnerabilities in two remote management tools used by managed service providers" to reach those providers' customers.

That last route is the vendor door. A small firm that pays an outside IT company to manage its computers inherits that company's remote access tools. If the IT company's account is taken over, the attacker arrives with the same rights the firm granted its support provider.

Tax season raises the stakes. A locked office in February costs more than a locked office in July, because every day of downtime is a day of returns not filed. The emails that open the first door are covered in the post on phishing scams targeting tax preparers, and the habits that keep staff from clicking are the subject of security awareness training for accounting staff.

Ransomware-resistant backups for client files

A ransomware-resistant backup is a copy of client files that the attacker cannot reach from an infected computer. That means at least one copy kept offline or in storage that cannot be changed for a set period, alongside the everyday backup. A backup the firm has never restored from is a hope, not a backup, so test it.

Backups are one of the six protections the IRS asks every tax professional to use, explained in the post on the IRS Security Six. This section covers what makes a backup survive ransomware specifically.

The 3-2-1 rule

CISA's paper Data Backup Options (2012) sets out the 3-2-1 rule: "Keep 3 copies of any important file: 1 primary and 2 backups," "Keep the files on 2 different media types to protect against different types of hazards," and "Store 1 copy offsite (e.g., outside your home or business facility)."

For a small firm, that might look like this example: client files on the office file server (copy one), a nightly backup to a cloud backup service (copy two), and a weekly backup to an external drive that is unplugged and taken home by the owner (copy three).

Why the offline copy matters

Ransomware does not stop at the files on the infected machine. The CISA #StopRansomware Guide (September 2023) warns that "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups." The FBI notice puts the same point as a rule: "Ensure backups are not connected to the computers and networks they are backing up." IRS Publication 5293 (5-2018) asks preparers to "Back up sensitive data to a safe and secure external source not connected fulltime to a network."

Publication 4557 calls encrypted backups to external drives or the cloud "your best protection against ransomware attacks." It also suggests "a monthly backup schedule, or more often during the filing season." A firm that only backs up monthly could lose four weeks of returns in March.

Testing a restore before January

The CISA guide asks organizations to "regularly test the availability and integrity of backups in a disaster recovery scenario." In plain terms: pick a system, restore it from backup onto a spare machine or a test folder, and time how long it takes. Do it in the fall, when a failed test can still be fixed.

Backup restore test log (example)

The rows below are examples for a fictional firm, Lakeview Tax Group. The systems, times and results are illustrative.

The failed row is the useful one. It found a stale backup in September instead of during an attack in February.

Patching and remote access settings that block ransomware

Patching and remote access settings block ransomware by closing the doors it uses most: remote desktop exposed to the internet, known software flaws, and daily accounts with administrator rights. Turn on automatic updates, put remote access behind a VPN and multi-factor login, and give staff standard accounts for everyday work.

Close remote desktop to the internet

Remote Desktop Protocol, or RDP, lets someone control a computer over a network. It is convenient for a preparer working from home and convenient for an attacker. The CISA guide's advice is direct: do not expose services such as remote desktop protocol on the web. The FBI notice recommends "auditing your network for systems using RDP, closing unused RDP ports, applying two-factor authentication wherever possible, and logging RDP login attempts."

If staff need to reach the office from home, put that access behind a VPN and multi-factor login; the IRS treats both as baseline protections, as the post on the IRS Security Six explains. Safe connections from a home office are the topic of remote work security for tax preparers.

Turn on automatic updates

The FBI notice says to "Patch the operating system, software, and firmware on devices" and to "Ensure anti-virus and anti-malware solutions are set to automatically update." Publication 4557 adds that browsers should be "set to update automatically." For a small office, the practical step is to check each workstation's update settings once and leave automatic updates on, including on the server and the router.

Remove admin rights from daily accounts

An administrator account can install software and change system settings. If a staff member opens a malicious attachment while signed in as an administrator, the malware gets those same rights. The CISA guide recommends applying the principle of least privilege and using designated admin accounts only for admin work. NIST Special Publication 800-114 Rev. 1 (July 2016) describes the same habit for home computers: "using the standard user accounts for daily use."

A simple setup: each person signs in every day with a standard account, and the owner or IT provider keeps a separate admin account used only to install software.

What should a firm do in the first hour of a ransomware attack?

In the first hour of a ransomware attack, a firm should disconnect affected computers from the network, leave them powered on if possible so evidence survives, call its cyber insurer and IT provider, and contact the IRS Stakeholder Liaison, the FBI and CISA. Do not wipe and rebuild until someone has captured what happened.

The CISA guide's response checklist starts with identifying which systems are affected and isolating them. If several systems appear affected, it suggests taking the network offline at the switch, and powering devices down only if they cannot be disconnected. It also asks responders to preserve evidence, such as a system image and memory capture from affected devices, before rebuilding.

Publication 4557 adds the contacts: "If you are a victim of a ransomware attack, please contact the FBI and Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security (DHS) in addition to the IRS." Publication 5293 lists the insurance company, both to report the breach and to check whether the policy covers breach costs. Read the policy before an attack, so the first call goes to whoever the insurer expects to hear from.

The IRS call goes to the firm's Stakeholder Liaison. What to say and what the IRS does next is explained in calling the IRS Stakeholder Liaison after a data theft.

The FTC Safeguards Rule at 16 CFR 314.4 (eCFR, current as of October 14, 2026) requires "a written incident response plan" covering, among other things, "clear roles, responsibilities, and levels of decision-making authority." Firms holding customer information on fewer than 5,000 consumers are exempt from that written plan, as the post on Safeguards Rule exemptions for small tax firms explains. A small firm may not be required to write one, but the first-hour card below costs ten minutes.

First-hour ransomware response card (example)

Fill in the blanks, print it, and keep a copy outside the office network. The names and numbers below are placeholders.

Should an accounting firm pay a ransomware demand?

Whether an accounting firm pays a ransomware demand is a business and legal decision, but federal guidance discourages it. The FBI does not advocate paying, the Treasury warns that payments to sanctioned groups can violate sanctions law even without knowledge, and paying does not remove the duty to report stolen client data.

The FBI notice states: "The FBI does not advocate paying a ransom, in part because it does not guarantee an organization will regain access to its data." It adds that "Regardless of whether you or your organization have decided to pay the ransom, the FBI urges you to report ransomware incidents to law enforcement."

The Treasury's Office of Foreign Assets Control (OFAC) addresses sanctions risk in its Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (September 21, 2021). It says "The U.S. government strongly discourages all private companies and citizens from paying ransom or extortion demands." It also explains that OFAC "may impose civil penalties for sanctions violations based on strict liability," which means a person "may be held civilly liable even if such person did not know or have reason to know" the payment was prohibited. The advisory treats a prompt, complete report to law enforcement or CISA as "a significant mitigating factor."

Paying also leaves the reporting question untouched. The CISA guide titles its response checklist "Ransomware and Data Extortion," because an attacker may copy files as well as lock them, so a firm that gets a decryption key may still have lost client data. A theft of client data can trigger a notice to the FTC under the Safeguards Rule, covered in the Safeguards Rule breach notice to the FTC, and IRS and state reporting run separately. This post does not give legal advice; a firm facing a demand should speak with its insurer and a lawyer.

Ransomware edge case: cloud sync that copies encrypted files

Cloud sync spreads ransomware damage because a sync client copies every change on the laptop to the cloud, including the change from a readable file to an encrypted one. Mapped network drives behave the same way. Version history can roll files back, but only within its retention window and only after every device is cleaned.

A sync folder is not a backup. When ransomware encrypts a file inside a synced folder, the sync client treats the encrypted file as the latest version and uploads it. Every other computer syncing that folder then downloads the encrypted copy. A mapped drive, which is a shared folder on another computer that appears as a drive letter, is written to directly, so an infected laptop can encrypt files on the server it maps.

Version history helps, within limits. Microsoft's support page Restore your OneDrive says the feature lets Microsoft 365 subscribers "undo all the actions that occurred on any files and folders within the last 30 days." An attack found on day 31 falls outside that window. Microsoft's page on ransomware detection and recovering your files warns that devices must be cleaned first: "Otherwise, your files could get encrypted again when you restore them."

Two habits limit the damage. Keep the offline copy from the 3-2-1 rule outside any sync, so it cannot be overwritten. And keep the number of places client files live small: one intake route per client means fewer synced folders to roll back. Schema CPA gives each client one upload link and lists, per client, which of last year's documents have arrived, so after a restore a firm can compare that list against what it recovered and re-request only the gaps; the client tracker demo shows the per-client view.