A four-partner accounting practice in Toronto opens Outlook on a Monday morning in February. Every email since Friday returns an error. A note pinned to the accounts payable folder demands 12 bitcoin, payable within 72 hours, or the client tax files land on a public leak site. The senior partner calls CPA Ontario before calling the RCMP.
What the firm does not know that morning: the attackers have been inside for 47 days.
During those 47 days the attackers read four T1 personal tax returns for high-net-worth clients (each with full Social Insurance Numbers, complete asset disclosure, and offshore account references); two corporate T2 filings for private companies mid-acquisition; audit work papers naming three bank accounts and internal-control weaknesses at a mid-market client; a payroll master file with 240 employees' banking details; and confidential retainer correspondence for approximately 180 active engagements. All of that material was copied to an attacker-controlled server before the ransom message arrived. The ransom is the last step of the operation, not the first.
The tax files were worst. Each T1 return contained a Social Insurance Number, employer, income, capital gains, medical expenses, and dependants. The corporate returns exposed related-party transactions and pending M&A structuring. Payroll gave the attacker every client-firm employee's banking information. In every documented small-accounting-firm ransomware disclosure of the past three years, tax files were the first material to reach public leak indices — because the SIN + income + address combination is the single most valuable exfiltration payload an attacker can lift from a professional-services firm.
The industry response to small-firm ransomware has settled on two controls: multi-factor authentication on email accounts, and daily encrypted backups of the file server. Both are reasonable. Neither addresses the fact that in the operation described above, the confidentiality breach happened on day one of the 47-day window, not day 47.
Why "MFA and backups" misses this
Backups protect availability. The firm can restore the file server and the mail store from backup, and the practice-management platform will look identical to what it looked like on day 46. The material is still on the attacker's server. Restoring from backup does not un-exfiltrate what has already been read.
Multi-factor authentication protects the sign-in event. In FBI-reported business email compromise cases where investigators reconstructed the initial intrusion, over 80 percent of victims had multi-factor authentication enabled at the time of compromise. Adversary-in-the-middle phishing pages, sold as commercial kits, capture the session cookie after multi-factor authentication passes. The attacker holds the session for the length of the session lifetime, which on default Microsoft 365 or Google Workspace configurations runs into weeks.
The CPA regulatory disclosure obligation triggers on the confidentiality breach, not on the ransomware deployment. Whether the firm pays the ransom or restores from backup, the notification duty to affected clients and to the provincial CPA order (and where the file contains payment-card or SIN data, to the applicable privacy regulator under PIPEDA) is the same. The reputational and regulatory outcome is set at the moment the attacker reads the first tax return.
The actionable question is not "how do we recover after the ransom message?" The actionable question is: how did the attacker get 47 days of resident access to privileged client financial material?
The 47-day reconnaissance chain
Attackers do not choose target firms at random. The pattern below is documented across ransomware advisory reports from the Canadian Centre for Cyber Security, the FBI Internet Crime Complaint Center, and the major incident-response firms. PBMares (a Top 100 US accounting firm) disclosed the same chain in its 2024 Silent Ransom Group incident, and the pattern has recurred across small and mid-size accounting firms in every subsequent quarter.
Step one: identity mapping from public records
Small and mid-size accounting firms are among the most exhaustively documented professional-services businesses in Canadian public data. Provincial CPA order directories publish every practising CPA's name, licence date, firm affiliation, and specialty. Corporate registries expose the firm's directors and principal address. Firm websites publish partner biographies, direct dial numbers, and email addresses. LinkedIn shows the full staff roster. Aggregated across these sources, an attacker can construct a complete personnel and workflow map of the firm before any technical activity begins — including which partners handle high-net-worth files, which staff run payroll, and who signs off on wire transfers.
Step two: breach-database credential correlation
With names and email addresses identified, attackers query breach databases for credential exposures matching those addresses. The current password is rarely the goal. Historical passwords across a decade of consumer data breaches produce patterns. A partner who used a variant of the same password on a professional network in 2016, on a design suite in 2013, and on a file-hosting service in 2012 is telegraphing exactly how they construct passwords in 2026. Most accounting-firm staff email accounts are protected by passwords that a determined attacker can guess inside a small number of attempts once the historical pattern is known.
Step three: adversary-in-the-middle multi-factor authentication bypass
The industry has moved to multi-factor authentication on business email. This does not stop the reconnaissance. Adversary-in-the-middle phishing pages proxy the real sign-in flow. The user completes the multi-factor authentication challenge. The attacker captures the resulting session cookie. From that point forward the attacker holds an authenticated session for as long as the tenant's session lifetime allows, and the sign-in event looks normal in the audit log because it was a real sign-in that the real user completed.
Step four: persistence through inbox rules and OAuth grants
Once inside, the attacker does not sit visibly logged in. They create inbox rules that auto-forward specific message threads (anything with "tax return", "T4", "wire", or client names) to an external address. They grant themselves an OAuth token to a third-party application the firm has never used, which survives the user changing their password. They register a rogue device under the user's account. Each of these persistence mechanisms is invisible to a user checking their normal Outlook or Gmail view.
Step five: silent exfiltration during tax season
By week two of the compromise, the attacker has identified which mailboxes hold the high-value material. Partner accounts. The tax-preparation staff processing return-season volume. The controller who manages trust-account and payment reconciliations. During tax season the volume of legitimate PDF-attachment traffic (T1 packages, T4 summaries, financial statements) is so high that the attacker's exfiltration blends into normal firm activity. On the majority of small-firm tenants, there is no data loss prevention policy monitoring outbound message content, and the attacker's exfiltration is not detected until they announce it.
Step six: the ransom message
On day 47, the attacker deploys the encryption payload and sends the ransom message. By this point the exfiltrated material has been reviewed, indexed, and prepared for either public leak or private sale. Payment of the ransom does not recover the copied material. It only stops the public disclosure timer.
What every small firm's external surface reveals
The reconnaissance chain relies on data the firm already publishes, plus data that leaked in incidents outside the firm's control. Neither is fixable through backup improvements. Both are addressable through configuration.
Across the professional-services landscape LeakTrace analyses, three exposures show up on almost every small accounting-firm external surface, and each one shortens the attacker's path by weeks.
Missing or misconfigured email authentication
DMARC, SPF, and DKIM are the three DNS records that determine whether an inbound mail server will accept a message claiming to be from the firm's domain. On most small-firm domains, at least one of these records is missing, weakly configured, or set to a permissive mode that does not enforce rejection. When email authentication is not enforced, an attacker impersonating the firm can send fake payment-instruction emails to the firm's own clients — a wire-fraud pattern that averages six-figure losses per incident in the FBI IC3 2024 Internet Crime Report.
Executive personal data on public broker sites
Senior partners' home addresses, phone numbers, family relationships, and property history are aggregated by data broker sites, republished, and made searchable. This is the material used to construct pretext phone calls to junior staff, to bypass "verify with a person you know" controls, and to add the personal detail that makes a phishing message land in the partner's actual inbox. Removal at the broker level once does not durably fix this. The brokers re-scrape public records every thirty to ninety days and the data reappears.
Weak conditional access on business email
Default Microsoft 365 and Google Workspace configurations grant session lifetimes measured in weeks, allow sign-ins from any country, and do not require re-authentication when the client fingerprint changes. Every one of those defaults is configurable. Almost none of them are configured on typical small-firm tenants.
None of these exposures require a breach to fix. Each one is a configuration decision.
What actually stops the 47-day compromise
The controls that break the reconnaissance chain sit in the window before the ransom message, not the hours after it.
Enforce DMARC at reject. Rotate DKIM keys on a fixed schedule. Publish MTA-STS so mail servers accepting messages from the firm's domain use encrypted transport. These changes take a knowledgeable IT contact under two hours and require no purchases.
Configure conditional access on business email to reject sign-ins from countries the firm does not operate in. Set session lifetime to a value measured in hours, not weeks. Require re-authentication when the sign-in fingerprint changes. Enrol every mailbox in phishing-resistant multi-factor authentication, not SMS.
Audit every mailbox in the tenant for user-defined rules that forward externally, move messages on financial or tax-related keywords, or hide replies from specific senders. This is the single highest-yield check for detecting an in-progress compromise. In every documented business email compromise case, the attacker created one of these rules to maintain persistence. Reviewing the ruleset takes a mail administrator about an hour per tenant.
Enable data loss prevention rules on outbound messages so that the pattern of "hundreds of megabytes of PDF attachments sent to a personal address never previously in the send graph" produces an alert instead of no signal at all.
Continuously monitor senior partners' personal data across the North American data broker landscape and submit removal requests through each site's opt-out flow. This is a subscription operation. Attempted once and abandoned, it decays inside sixty days.
Why this matters now
The CPA regulatory disclosure obligation on a small firm does not care whether the encryption payload deployed successfully or the backup restored cleanly. It cares that a confidentiality breach happened. Where the compromised file contains SIN data, PIPEDA breach-notification duty attaches on top. In the operation described at the top of this briefing, both duties attached on day one of the 47-day window. Everything after that was the attacker deciding when to force the firm to disclose.
Small firms that want to actually reduce exposure have to intervene at the reconnaissance stage. That means treating the external attack surface, the credential exposure landscape, the executive personal data footprint, and the tenant's own persistence-mechanism surface as continuously monitored surfaces. It also means auditing mailboxes on a schedule that reflects the attacker's operational tempo, not the firm's calendar.
The exposure is already indexed. The question is whether the firm has mapped its own footprint before the attacker did.