The Biggest Cybersecurity Mistakes Canadian Accounting Firms Make During Tax Season

In my sysadmin work setting up shared infrastructure, I’ve learned that Canadian accounting firms face coordinated pressure during tax season—not from random attackers, but from organized campaigns targeting high-value credential stores. According to the 2025 CIRA Cybersecurity Survey, 74% of Canadian ransomware victims chose to pay ransom rather than recover from backups ([CIRA 2025 Cybersecurity Survey](https://www.cira.ca/en/resources/documents/cybersecurity/2025-cybersecurity-survey/)) (CIRA 2025), a pattern that reflects how under-prepared most firms remain when under deadline pressure.

From an infrastructure standpoint, tax season creates three structural vulnerabilities: staff moving at speed, temporary workers onboarded with minimal security friction, and credentials reused across shared workstations. The CRA’s EFILE program assigns filers personal responsibility for safeguarding credentials and implementing reasonable technical safeguards ([CRA EFILE Service Standards (2026) / Canada Revenue Agency](https://fusioncomputing.ca/cra-efile-security-canadian-accounting-firms/))—but from my sysadmin experience, most accounting firms have no documented process for managing those credentials internally. Under PIPEDA’s safeguarding obligation, that gap becomes a mandatory breach notification responsibility the firm is rarely equipped to execute. The CPA Canada Handbook (Part 1, Section 3.1.4) also requires CPAs to maintain confidentiality and implement appropriate security controls—but tax season creates pressure to skip documentation.

The Five Biggest Mistakes Canadian Accounting Firms Make During Tax Season

Mistake #1: Shared EFILE Credentials Across Workstations

From an infrastructure standpoint, this is the easiest vulnerability to spot. A single CRA EFILE login is shared among 3–5 staff members on the same workstation, stored in a browser password manager or (worse) a sticky note. When a temporary staff member leaves, the password is never reset. The CRA’s safeguarding obligation requires “reasonable technical safeguards” but does not dictate how firms implement them internally—which creates ambiguity firms exploit.

What To Do This Week: Audit your EFILE login inventory. Count how many unique credentials your firm uses, who has access to each, and whether temporary staff have been de-provisioned. Document this in a shared spreadsheet. That document becomes your baseline for PIPEDA compliance. Use our EFILE Credential Audit Worksheet to accelerate this.

Mistake #2: No Formal Onboarding Process for Temporary Tax Season Staff

According to the Canadian Centre for Cyber Security (CCCS) guidance on supply chain security (“Securing Your Organization Against Ransomware and Other Malware,” Government of Canada, 2023), onboarding speed is a common failure point. Tax season hires often receive a workstation login and a password written on a whiteboard. They are not trained on phishing indicators, credential handling, or email forwarding rules. When they leave in April, their access is often not immediately revoked.

Under PIPEDA Section 4.7 (Retention and Destruction), firms must have a documented process for destroying access credentials and personal data when contractors leave. Most accounting firms treat tax season hires as “no problem” because they assume turnover is temporary—but PIPEDA does not distinguish temporary from permanent staff.

What To Do This Week: Create a one-page tax season onboarding checklist. Include: (1) Credential provisioning date, (2) Security training attestation, (3) Email forwarding rules disabled, (4) Multi-factor authentication (if available), (5) De-provisioning date in writing. Require the hiring manager to sign it before the employee’s first day. Store copies in a shared folder for audit trail.

Mistake #3: Email Forwarding Rules Left Active After Contractors Depart

From my sysadmin work, this is the highest-ROI attack vector in accounting firms. A tax season contractor sets up an email forwarding rule to their personal inbox to “stay organized.” Six weeks later, they’re gone—and the rule is still active. Any email sent to that contractor account is now forwarded to an external inbox controlled by the attacker (if the contractor account was compromised) or an unmonitored personal account.

CPA Canada’s guidance on data security (Handbook Part 1) assumes firms maintain an active inventory of access controls. Most do not. Under PIPEDA’s accountability principle (Section 4.1), the firm is liable for unauthorized access, even if the contractor’s negligence caused it.

What To Do This Week: Audit your mail server or Microsoft Exchange for active forwarding rules on contractor and temporary accounts. Use PowerShell (Get-Mailbox -ResultSize Unlimited | Get-MailboxForwarding) or contact your email provider. Delete any forwarding rules dated before January 1 of the current year. Document deletions in a log file.

Mistake #4: Client Tax Data Stored on Personal Devices Without Encryption

Tax season accelerates the use of personal laptops, tablets, and phones to access or store client financial data. From an infrastructure standpoint, this is a PIPEDA breach waiting to happen. The moment a personal device containing unencrypted tax data is lost, stolen, or breached, the firm must notify affected clients under PIPEDA Section 4.9 (Breach Notification).

The Canada Revenue Agency (CRA) does not explicitly forbid this practice in the EFILE Agreement, but CRA Letter of Ruling CIR 87-1R1 clarifies that tax filers are responsible for securing client information. If a client sues the accounting firm for breach, the firm cannot defend itself by blaming personal device use if no encryption was in place.

What To Do This Week: Survey your team: “Has anyone stored client tax documents on a personal device in the last 60 days?” Require honest answers. For any “yes,” initiate a data deletion process and document it. Going forward, enforce a policy: all personal devices accessing firm data must use full-disk encryption (BitLocker on Windows, FileVault on Mac) and multi-factor authentication. See our Personal Device Policy Template.

Mistake #5: No Backup or Disaster Recovery Plan Tested Before Tax Season

From my sysadmin experience, accounting firms assume ransomware “won’t happen to us.” The 2025 CIRA survey cited earlier shows that 74% of Canadian ransomware victims paid ransom—a sign they had no tested backup. Under OSFI guidance for financial services (which includes accountant-led tax and bookkeeping roles), a Recovery Time Objective (RTO) of more than 4 hours during tax season is considered negligent.

Tax season is the worst time to discover your backups don’t work. PIPEDA accountability requires firms to “take reasonable steps” to protect data. A backup process that has never been tested is not reasonable.

What To Do This Week: Document your current backup strategy: Where are backups stored? How often? Who has access? Then, run a restore test on a non-production system. Record the time required to restore 100% of client data. If it takes more than 4 hours, escalate to leadership. If you have no backup strategy, implement one immediately using our Backup & RTO Assessment Tool.

Frequently Asked Questions

Q: Are we required to use multi-factor authentication (MFA) for EFILE access?

The CRA does not mandate MFA in the EFILE Agreement, but PIPEDA’s safeguarding obligation (Section 4.7) requires “reasonable technical safeguards.” As of 2024, industry standard for financial services access is MFA. A firm that does not implement it cannot defend a breach to a regulator or client. Hedge: Where CRA-approved MFA tools are available, they should be used.

Q: If a contractor loses a personal device with client data, are we required to notify the client?

Yes. Under PIPEDA Section 4.9 (Breach Notification), a firm must notify clients of a reasonable belief that personal information has been accessed without authorization. A lost device containing unencrypted client tax data meets this threshold. Notification must occur without unreasonable delay (typically within 30 days) and must include the date of the loss, types of information involved, and recommended mitigation steps (e.g., credit monitoring).

Q: Can we use a shared password manager (like LastPass) for EFILE credentials?

Shared password managers solve one problem (credential reuse) but create another (shared access). From an infrastructure standpoint, a better approach is role-based access with individual credentials and audit logging. The PECB course taught me that access controls should follow the principle of least privilege: each staff member gets access only to systems they need. A shared EFILE credential violates this principle. If shared password managers are used, they must have: (1) Multi-factor authentication, (2) Audit logging enabled, (3) Admin oversight of access grants, and (4) Regular access reviews.

Q: How do we handle PIPEDA compliance if we’re an unincorporated sole practitioner?

PIPEDA applies to all organizations that process personal information, including sole practitioners. Unincorporated status does not exempt you. The safeguarding and accountability obligations remain. CPA Canada’s Handbook guidance applies equally.

Q: What is the difference between a PIPEDA breach notification and a CRA breach report?

PIPEDA is a privacy law managed by the Office of the Privacy Commissioner (OPC). A breach requires notification to affected individuals and (in some cases) to the OPC. The CRA has its own breach reporting process (Letter CIR 87-1R1) but does not replace PIPEDA. Both may apply. A firm must comply with whichever standard is stricter.

Scorecard: Is Your Firm Tax-Season Ready?

Use this quick checklist to assess your firm’s readiness:

• EFILE credentials are unique per staff member (not shared).
• All tax season contractors have signed an onboarding checklist.
• Email forwarding rules are audited and cleaned monthly.
• No client tax data is stored on personal devices without full-disk encryption.
• Backup restoration has been tested in the last 90 days, documented, and RTO recorded.
• De-provisioning process is documented and followed for all contractor departures.
• PIPEDA breach notification process is written and reviewed by legal counsel.
• Staff have completed phishing and social engineering awareness training this year.

If you checked fewer than 6 boxes, your firm is at elevated risk during tax season. Take the free 7-minute cybersecurity risk scorecard for a personalized action plan based on your firm’s size and current security posture.

What To Do This Week: Summary

1. Audit EFILE credentials: Count unique logins, identify shared access, document in a spreadsheet.
2. Create onboarding checklist: Require sign-off before contractors start.
3. Scan for email forwarding: Delete old rules; log deletions.
4. Survey personal device use: Initiate data deletion for any stored tax documents; enforce encryption policy going forward.
5. Test backups: Restore to a non-production system; record RTO; escalate if over 4 hours.

Get My Free Risk Score

Disclaimer: This post is based on the author’s experience as a systems engineer and PECB ISO 27001 Provisional Auditor (no current clients). It reflects general best practices and regulatory guidance from PIPEDA, CPA Canada, the CRA, and the Canadian Centre for Cyber Security. It is not legal or compliance advice. Consult a lawyer or compliance officer for your firm’s specific context.