Optima Tax Relief Hit by Chaos Ransomware Attack, Exposing 69GB of Sensitive Data A prominent U.S. tax resolution firm, Optima Tax Relief, has fallen victim to a ransomware attack by the Chaos group, which claims to have stolen 69GB of sensitive data before encrypting the company’s systems. The breach, disclosed earlier this week, includes customer case files containing highly valuable personal and financial information, such as Social Security numbers, home addresses, and phone numbers data that cybercriminals can exploit for identity theft and financial fraud. The attack follows a double-extortion tactic, where the ransomware gang not only encrypts victim data but also threatens to leak it unless a ransom is paid. While Optima has not publicly confirmed whether it will pay or notify affected individuals, the incident raises concerns about regulatory compliance and consumer protection, particularly given the firm’s handling of tax-related records. Chaos ransomware, which emerged in March 2025, has quickly established itself as a threat to high-value targets. Unlike an earlier DIY ransomware toolkit of the same name, this group operates as a coordinated team, strategically targeting organizations with access to large volumes of personally identifiable information (PII). Optima is not the group’s only recent victim Chaos also claimed an attack on the Salvation Army in May, though the organization has not confirmed the breach. As of now, Optima has not issued an official statement, and there is no confirmation of law enforcement or federal agency involvement. The full dataset has not been published, but the leak site listing alone underscores the growing risk of ransomware attacks on financial service providers, which have increasingly become prime targets for cybercriminals. Unlike other breached data, tax information cannot be easily reset, leaving victims vulnerable to long-term fraud and reputational harm.

Optima Tax Relief, a leading U.S. tax resolution firm, suffered a Chaos ransomware attack resulting in the leak of 69 GB of data. The stolen data includes corporate information and customer case files, which contain sensitive personal information such as Social Security numbers, phone numbers, and home addresses. This data breach poses a significant risk of identity theft and other malicious activities. The attack was a double-extortion scheme, where data was both stolen and servers were encrypted.

The Vermont Office of the Attorney General reported that Optima Tax Relief experienced a data breach in November 2022, which was disclosed to the public on May 2, 2023. The breach potentially exposed personal information including names, mailing addresses, dates of birth, and social security numbers. The number of individuals affected is unknown.

On December 1, 2019, Optima Tax Relief, LLC experienced an external system breach (hacking) that went undetected until November 2, 2022. The incident, reported by the Maine Office of the Attorney General on May 2, 2023, compromised sensitive personal data of 5,027 individuals, including 15 Maine residents. The exposed information included Social Security numbers, a high-value target for identity theft. While the breach’s delayed discovery raised concerns about prolonged vulnerability, the company responded by offering 12 months of identity theft protection services to affected individuals. The attack’s focus on financial and personally identifiable information (PII) underscores its potential for severe downstream consequences, such as fraud or long-term reputational harm to the company. The breach’s scale and the nature of the stolen data—critical for tax and financial identity—highlight systemic risks in data security practices, particularly in sectors handling sensitive client information.