An accounting firm holds financial records for dozens or hundreds of businesses — tax returns, bank statements, payroll data, shareholder information. It also processes payments and has access to clients' financial systems. For attackers, compromising one accounting firm means access to many businesses at once.
In 2022, a New Zealand accounting practice with 12 staff was compromised through a phishing email. The attacker spent three weeks in the firm's email system before being detected — reading correspondence, identifying client relationships, and mapping the firm's payment processes. When they eventually acted, they used access to the firm's email system to redirect a client's tax refund payment and intercept a property settlement communication, redirecting the funds. Total loss: over $180,000 across two client matters.
The firm's cyber insurance covered a portion of the loss. The client relationships did not fully recover.
Why Accounting Firms Are Supply Chain Targets
Compromising an accounting firm is a supply chain attack on every business that firm serves. An attacker inside an accounting firm's email system can: monitor correspondence between the firm and clients to identify upcoming transactions, impersonate the firm to clients to redirect payments, access practice management data containing client financial information, and potentially access cloud accounting platforms (Xero, MYOB) if credentials are stored or accessible.
This is why CERT NZ specifically warns accounting firms about their role as a high-value supply chain target. Protecting your firm's systems is also protecting your clients.
The Payment Redirection Risk in Accounting
Accounting firms regularly communicate with clients about payment amounts, bank accounts, and fund transfers. This makes them a natural target for business email compromise attacks — both as the impersonated party (attackers impersonate the firm to clients) and as the victim (attackers impersonate clients or suppliers to the firm). A clear, communicated policy that any change in bank account details for payments will be verbally verified using a pre-established phone number is essential.
Practice Management System Security
APS, MYOB Practice, Xero Practice Manager, and similar practice management systems should be treated as critical systems with the highest security controls. Access should be MFA-protected, permissions scoped to role (junior accountants don't need access to all client files), and all access logged. Password credentials to these systems should not be stored in browser autofill or email — they should be in a business password manager with centralised management.
Professional Indemnity and Cyber Insurance
Most accounting practices carry professional indemnity insurance. It's important to confirm with your insurer whether your PI policy covers cyber-related claims — specifically payment redirection fraud resulting from a compromise of your systems. Many PI policies do not cover cyber incidents, requiring a separate cyber insurance policy. Given the financial exposure from a compromise of an accounting firm's systems, both covers are worth maintaining.
An accounting firm's liability isn't limited to errors in financial advice. A breach that leads to client financial losses through redirected payments or compromised financial information creates real and serious professional liability. Security is not separate from professional responsibility — it's part of it.
