The threats most likely to hit an accountancy practice are phishing, takeover of email accounts used to divert payments, ransomware, theft of HMRC agent sign in details, and compromise through a supplier. UK GDPR requires security appropriate to the risk, the ICO points to Cyber Essentials as a starting point, and ICAEW, AAT and HMRC each expect practices to protect client data, keep backups, train staff, control access to HMRC services and have a tested plan for when an attack succeeds.

Why are accountancy practices targeted?

Practices hold exactly what criminals want: identity details, National Insurance numbers, bank details, payroll data and access to clients’ HMRC records, together with a steady flow of payment instructions. Small firms are not exempt. The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of UK businesses had experienced a cyber security breach or attack in the previous 12 months, including 42% of micro and 46% of small businesses. Phishing was by far the most common type, experienced by 38% of businesses.

ICAEW’s Practice Assurance monitoring report 2026, which made cyber security its area of focus for discussions with 121 larger firms, found that 16% had suffered cyber attacks. Incidents included attempts to intercept payment instructions, compromised shared mailboxes, access to email accounts and systems through phishing, and ransomware.

What are the main threats to a practice?

  • Phishing and impersonation. Emails that copy HMRC, Companies House, software providers or clients. In February 2026 HMRC’s Digital Security Working Group, via CIOT, warned of scam emails claiming to be from HMRC and asking agents to update their anti money laundering supervision registration details. HMRC says it only emails from addresses ending in gov.uk.
  • Mailbox compromise and payment diversion. A criminal who controls a staff or client mailbox can send convincing requests to change bank details for fees, tax payments or client funds.
  • Ransomware. The ICO says that where ransomware encrypts personal data, that is a personal data breach because timely access has been lost, and that attackers now often copy data and threaten to publish it.
  • HMRC credential theft. Access to an agent services account exposes every authorised client.
  • Supplier compromise. Cloud software, IT support, payroll bureaux and outsourced teams all have some access. The offshoring guide covers the extra steps for overseas providers.
  • Leavers and over privileged users. Accounts that stay live after staff leave, or that can reach far more data than the role needs.

What does the law require?

Article 32 of UK GDPR requires a controller to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art and the cost of implementation. The ICO’s guide to data security says those measures must protect the confidentiality, integrity and availability of systems and data, must allow access to personal data to be restored in a timely manner after an incident, and must be regularly tested. It describes Cyber Essentials as a good starting point but only a base set of controls that will not address every organisation’s risks.

On ransomware, the ICO says it does not consider paying a ransom an appropriate measure to restore personal data, and that appropriate measures include risk assessment and controls such as offline and segregated backups. A breach that is likely to result in a risk to individuals must be reported to the ICO within 72 hours of the firm becoming aware of it where feasible, as explained in data protection for accountancy practices.

What do the professional bodies and HMRC expect?

ICAEW’s Code of Ethics requires members to keep information confidential and, as ICAEW’s confidentiality helpsheet puts it, to take all reasonable steps to preserve that confidentiality. Its 2026 monitoring report recommends that firms:

  • treat cyber risk as a business risk owned by a senior leader and include it in the risk register;
  • develop an incident response plan and test it at least annually;
  • assess suppliers, set minimum security standards and have protocols for new suppliers and changes to supplier bank details;
  • sign up to the NCSC Early Warning service;
  • control data exchange such as USB sticks and emails containing sensitive data;
  • train staff and monitor how breaches are identified and reported to the ICO.

AAT’s Practice Assurance Standards expect all electronic media to be secure, regular backups, protection from unauthorised access and viruses, and contingency arrangements for major systems failure. HMRC’s Standard for Agents expects agents to maintain the security of client information and keep HMRC credentials safe from unauthorised use at all times.

Which technical controls should come first?

Cyber Essentials is built on five technical control areas, which make a sensible baseline for any practice:

Control area What it means in a practice
Firewall configuration Only necessary services exposed to the internet, including on home routers used for work
Secure configuration Default passwords changed, unused software and accounts removed
User access control Named accounts only, access limited to the role, administrator rights restricted, leavers removed on their last day
Malware protection Protection on every device that handles client data
Security update management Operating systems and applications patched promptly and unsupported software retired

Two further controls deserve priority. Multi factor authentication on email, cloud accounting and document systems blocks most attacks that start with a stolen password; ICAEW found that 88% of the larger firms it spoke to required it, while the Cyber Security Breaches Survey found only 47% of businesses used two factor authentication. Backups that are separated from the main systems are what turn a ransomware attack from a disaster into an inconvenience, provided restores are tested.

How should a practice protect its HMRC agent access?

HMRC’s guidance for agents, updated on 13 May 2026, says agents should:

  • access client details using their own agent registration and not use clients’ sign in details;
  • never share sign in details, and set up administrators and standard users where others need access;
  • keep the list of administrators and assistants up to date;
  • check the HMRC account for unauthorised or unusual activity, such as changes to email addresses or added software;
  • sign in only through the web, not through a link in an email;
  • apply the same security to personal computers used for work as to office computers.

If suspicious activity is found, HMRC says to report it, check any third party software for unexpected changes such as bank details, and not attempt to correct anything in the account. User permissions are explained in HMRC agent services account.

How can payment diversion be stopped?

ICAEW reported that firms’ measures included staff training, calling suppliers to verify payment details and dual authorisation of payments. A practice should apply the same rule in both directions: no change to the firm’s own bank details is ever announced by email alone, and no change to a client’s or supplier’s details is accepted without a call to a number already on file.

Illustration only. A bookkeeper receives an email from a client director asking for this month’s payroll to go to a new bank account. The email address is correct because the director’s mailbox has been taken over. The firm’s procedure requires a call to the number on the client file; the director confirms she sent nothing, the payment is stopped and the client is told to secure the mailbox.

What should happen when an attack succeeds?

Follow the incident plan: isolate affected devices, preserve evidence, bring in IT support and, where held, the cyber insurer’s response team, assess whether personal data has been affected and decide on ICO and client notification within the 72 hour window. ICAEW found that of the larger firms that had suffered attacks, 84% reported the incident to bodies such as the NCSC, ICO, HMRC and ICAEW, 68% involved third party advisers and 58% involved their insurers. ICAEW also says it is best practice to review the nature and extent of cyber insurance cover regularly; see cyber insurance explained.

What mistakes do practices make?

  • Treating Cyber Essentials as the finish line rather than the baseline.
  • Backups that sit on the same network and are encrypted along with everything else.
  • Shared logins for HMRC, software or mailboxes.
  • No process for removing leavers’ access the day they go.
  • An incident plan that has never been rehearsed.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.