accounting firms 2026 threat landscape

The State of Secure Document Sharing in Accounting Firms (2026)

Post 3 of 10: The Threat Landscape Facing Accounting Firms

Part of the FileRecall Accounting Research Series

Accounting firms face one of the most aggressive threat landscapes of any professional services sector. The combination of identity data, financial records, corporate documents, and tax information makes these practices prime targets — and attackers have become increasingly sophisticated in how they exploit the specific workflows that accountants rely on every day.

This post provides a detailed analysis of the cyber threats facing accounting firms in 2026 — the attack vectors, the breach statistics, the real-world consequences, and why traditional document sharing methods leave firms dangerously exposed.

Why Accounting Firms Are Targeted

Before examining specific threats, it is worth understanding why accounting firms are targeted so aggressively.

The answer is straightforward: accounting firms hold some of the most valuable data in the economy, and they often lack the security infrastructure to protect it at the level enterprises do.

A single accounting client file may contain a tax file number, bank account details, identity documents, salary information, superannuation details, and years of financial history. Multiply that across hundreds of clients, and an accounting firm represents a concentrated repository of high-value personal and financial data that would be enormously valuable to a cybercriminal — for identity theft, financial fraud, or ransom.

Small and mid-tier practices are disproportionately targeted precisely because they hold enterprise-grade data without enterprise-grade defences. They are attractive targets with lower barriers.

The Six Major Threats Facing Accounting Firms

1. Phishing and Credential Theft

Phishing remains the single most common attack vector in accounting firm breaches, responsible for the vast majority of incidents. Attackers impersonate accounting software platforms, cloud sharing services, banks, the ATO, and even firm partners or clients to steal login credentials or trick staff into opening malicious content.

What has changed dramatically in recent years is the sophistication of these attacks. AI now allows attackers to generate phishing emails that perfectly mimic the writing style, branding, and communication patterns of legitimate platforms. A spoofed “secure document” notification from what appears to be Xero, MYOB, or the ATO — complete with accurate logos and formatting — is now indistinguishable from the real thing to most recipients.

Accounting firms are particularly vulnerable because staff are accustomed to receiving document-related emails constantly. The expectation of receiving attachments and links from clients, software platforms, and regulators is baked into the daily workflow — and attackers exploit that expectation deliberately.

2. Business Email Compromise (BEC)

Business email compromise occurs when attackers gain access to a firm’s email system — typically through credential theft — and manipulate communication threads to redirect payments, request fraudulent transfers, or intercept sensitive documents.

In accounting firms, BEC attacks are particularly dangerous because financial transactions are a core part of client work. An attacker who has compromised a partner’s email account can intercept a client’s tax refund bank detail update, alter it, and redirect the refund. They can send fraudulent invoice requests to clients. They can intercept documents being shared for review and substitute altered versions.

BEC is one of the most financially damaging attack types because it exploits trusted relationships rather than technical vulnerabilities — and it operates entirely within normal-looking email workflows that staff have no reason to question.

3. Ransomware

Ransomware attacks have surged across the financial sector. Attackers deploy malware that encrypts a firm’s files and demands payment — typically in cryptocurrency — before access is restored. For accounting firms, the consequences are severe and immediate.

During a ransomware attack, a firm loses access to client documents, cannot lodge tax returns, cannot process payroll, and cannot access the financial records needed to serve any client. The timing often compounds the damage — attackers frequently deploy ransomware during peak periods like tax season, when the disruption is most costly and firms are under the most pressure to pay quickly to restore access.

Ransomware commonly spreads through malicious email attachments disguised as client documents — the very vector that accounting firms interact with constantly. An attachment that appears to be a client’s bank statement or signed engagement letter can contain a payload that encrypts the entire firm’s file system within hours of being opened.

4. Document Interception and Unauthorised Forwarding

One of the most underappreciated threats facing accounting firms is the silent interception and unauthorised forwarding of documents shared through uncontrolled channels.

Email attachments and consumer cloud links with open permissions create persistent exposure. A tax return emailed to a client sits permanently in that client’s inbox — and potentially in the inbox of every person they have ever forwarded an email to, on every device they have ever used. A Google Drive link shared with “anyone who has the link can view” can be forwarded indefinitely, with no record of who has accessed it or where it has gone.

Document interception is particularly dangerous because it often goes completely undetected. The firm sends the document, the legitimate recipient receives it, and no one knows that the email was also accessed by an unauthorised party, or that the link was forwarded six times before landing in a place it was never meant to be.

5. Insider Threats

Industry research indicates that the majority of organisations experience at least one insider-related incident annually. For accounting firms, insider threats include both intentional misuse and accidental exposure — and the distinction matters less than the outcome.

Common insider incidents include:

Staff forwarding client documents to personal email accounts for convenience when working remotely
Contractors accessing documents beyond the scope of their engagement
Employees downloading client files to personal devices
Shared passwords that allow multiple parties to access systems under a single identity
Accidental misdelivery of documents to the wrong client

The seasonal nature of accounting work amplifies insider risk. During tax season, staff are under intense time pressure. Shortcuts that would normally be questioned become routine. Documents get sent to the wrong address because someone was working too fast to check. Files get downloaded to personal laptops because the office portal was slow. These are not malicious acts — but their consequences can be just as damaging.

6. AI-Generated Attacks

The emergence of AI-powered cyberattacks represents a step change in the threat landscape that affects every sector — but has particular implications for accounting firms.

Attackers can now use AI to generate highly convincing phishing emails, create spoofed login pages that clone a firm’s own branding, produce fake invoices with accurate client and supplier details, mimic the writing style of specific partners or managers, and automate credential-harvesting campaigns at scale.

The volume and quality of attacks that AI enables means that the old approach of training staff to spot “suspicious” emails is increasingly unreliable. AI-generated attacks are designed not to look suspicious — they look exactly like the legitimate communications staff receive every day.

Why Traditional Document Sharing Methods Accelerate These Risks

Each of the six threats above is made significantly worse by uncontrolled document sharing practices.

Email attachments create exposure across every threat category. They can be intercepted in transit, misdelivered, forwarded without permission, used as phishing vectors, and accumulated in inboxes indefinitely with no expiry or revocation mechanism. Once an email is sent, the sender has no control over what happens to it.

Consumer cloud links extend the exposure further. A Dropbox or Google Drive link shared with a client can be forwarded to anyone. Without expiry controls, that link remains active indefinitely — accessible to anyone who has ever received it, regardless of whether the original sharing purpose has long since passed.

The common thread across all of these failure modes is the same: loss of control after sending. Once a document leaves the firm through a traditional channel, the firm has no visibility into where it goes, who accesses it, or how long it remains accessible.

The Solution: Eliminating the Exposure at the Source

The most effective response to this threat landscape is not better email filters or staff training alone — it is eliminating the exposure that uncontrolled document sharing creates in the first place.

Controlled-access document sharing removes the primary attack vectors by design:

Documents are never delivered as downloadable files — they are streamed through a secure viewer that never delivers the source file to the recipient’s device
Every page carries a permanent watermark with the recipient’s email and access timestamp — burned into the page image, not a removable overlay
Access expires automatically at a time the sender defines — no permanent exposure
Links can be revoked instantly if circumstances change — no waiting, no negotiating with recipients
Every access is logged with a full audit trail — timestamp, device, location

This is not a partial mitigation. It directly addresses the document interception, unauthorised forwarding, and insider threat vectors that traditional sharing methods leave wide open.

The Cost of Getting This Wrong

For accounting firms that experience a document-related breach, the consequences are multidimensional and severe.

Financial — direct costs include regulatory penalties under the Privacy Act, mandatory breach notification processes, legal fees, and potential client compensation. Indirect costs frequently exceed the direct costs.
Reputational — an accounting firm’s reputation rests on the trust clients place in it to handle their most sensitive financial information. A document leak can permanently damage that trust.
Regulatory — a notifiable data breach triggers mandatory reporting obligations under the Privacy Act’s Notifiable Data Breaches scheme. Regulatory investigations are time-consuming, disruptive, and public.
Operational — a ransomware attack or major breach can render a firm unable to operate for days or weeks at the worst possible time — during tax season, at year-end, during audit periods.

Next in this series: Post 4 — Regulatory & Compliance Environment →

← Back to: Post 2: Why Secure Sharing Matters

View the full series index →