Optima Tax Relief Suffers Ransomware Attack, Customer Data Exposed
▼ Summary
– Optima Tax Relief, a leading U.S. tax resolution firm, suffered a Chaos ransomware attack, with 69 GB of stolen data leaked by the hackers.
– The leaked data includes corporate files and customer case files, potentially containing sensitive personal information like Social Security numbers and addresses.
– The attack was a double-extortion incident, involving both data theft and server encryption by the Chaos ransomware gang.
– Chaos ransomware is a new operation launched in March 2025, distinct from the older Chaos ransomware builder used in phishing campaigns.
– The same ransomware group also claimed to breach the Salvation Army, which did not respond to inquiries about the incident.
Optima Tax Relief, a prominent U.S. tax resolution company, recently fell victim to a ransomware attack by the Chaos group, resulting in the exposure of sensitive customer data. The breach highlights growing cybersecurity risks facing financial service providers handling confidential client information.
The attackers reportedly stole 69 GB of data, including corporate files and customer case records. Given the nature of tax-related documents, the compromised information likely contains highly sensitive details such as Social Security numbers, addresses, and financial records, making it a prime target for identity theft and fraud.
Insiders familiar with the incident confirmed this was a double-extortion attack, where hackers not only encrypted Optima’s servers but also exfiltrated data to pressure the company into paying a ransom. The Chaos ransomware group, which emerged earlier this year, has already claimed multiple high-profile victims, including the Salvation Army in a separate breach.
While Optima Tax Relief has yet to publicly address the incident, the exposure of client data raises serious concerns about data protection practices in the tax resolution industry. The company, which boasts resolving over $3 billion in tax liabilities, now faces potential reputational damage and regulatory scrutiny.
Chaos ransomware should not be confused with the older Chaos builder tool, a separate malware framework used in phishing campaigns since 2021. The newer group appears to be escalating its operations, targeting organizations with valuable data.
Efforts to obtain an official statement from Optima Tax Relief are ongoing, and updates will follow if new details emerge. For affected clients, monitoring credit reports and financial accounts for suspicious activity is strongly advised.
(Source: Bleeping Computer)
