Ransomware Targets Professional Services Firms: What Federal Data Says About Accountants and Consultants

Ransomware targets professional services firms at an accelerating rate — and the 2024 federal data makes this impossible to ignore. Accountants, management consultants, advisory practices, and financial planning firms have quietly become among the most attractive targets in the ransomware economy. Not because they are easy marks in the traditional sense, but because the math works out perfectly for attackers: these firms hold enormous volumes of sensitive client data while running security programs that are a fraction of what that data is worth in a ransom negotiation. This post breaks down what that data shows, who is most exposed, what real attacks look like, and what every professional services firm should be asking their IT firm right now.

The Threat Landscape: What Federal Data Tells Us About How Ransomware Targets Professional Services Firms

The FBI’s Internet Crime Complaint Center published its 2024 Internet Crime Report in April 2025, and the headline numbers are stark. Ransomware complaints increased 9% from 2023 to 2024, with reported losses growing 11%. But aggregate numbers hide the most important story. Filter by industry category and the picture becomes clear: ransomware targets professional services firms — legal, accounting, consulting, and advisory practices — which consistently rank among the top five most-targeted sectors by incident volume.

The 2024 IC3 report identified ransomware as the most destructive form of cybercrime by financial loss per incident across all business categories. The average reported loss per incident across all sectors exceeded $200,000 — but losses at professional services firms ran higher, because ransom demands are calibrated to the perceived value of the data held. A firm managing sensitive financial records, merger documents, regulatory filings, or pharmaceutical client data will receive a larger demand than a retail shop that got hit. You can review the FBI IC3’s full ransomware data at fbi.gov/investigate/cyber.

CISA’s advisories throughout 2024 and into 2025 have repeatedly flagged a structural vulnerability in the professional services sector. Ransomware targets professional services firms specifically because they hold third-party client data — and that creates compounded pressure to pay. In multiple joint advisories with the FBI and international partners, CISA noted that ransomware groups actively conduct pre-attack reconnaissance to identify firms holding third-party client data, because those firms face pressure not just to protect their own data, but data that belongs to clients who have their own regulatory and reputational obligations. That compounded pressure is a feature of the attack, not a side effect. You can review CISA’s current ransomware guidance at cisa.gov/stopransomware.

Who It Affects: The Professional Services Bull’s-Eye

Not every small business faces the same level of ransomware risk. The threat is concentrated in firms that share three characteristics: they hold client data with value beyond their own four walls, they operate with lean IT budgets relative to their revenue, and they have not historically viewed themselves as cybersecurity targets. Understanding why ransomware targets professional services firms starts with understanding this risk profile.

The professional services categories most frequently named in federal advisories and documented incidents include:

• Accounting and CPA firms, which hold tax returns, payroll records, bank statements, and financial projections for dozens or hundreds of businesses and individuals at any given time.
• Management and strategy consulting firms, which often hold board presentations, unreleased financial forecasts, merger and acquisition due diligence files, and sensitive operational data from active client engagements.
• Financial advisory and wealth management practices, which hold net worth statements, investment portfolios, estate planning documents, and Social Security numbers for high-net-worth individuals.
• Pharmaceutical and life sciences consultancies, which hold client-owned regulatory submissions, clinical data summaries, and proprietary formulation records carrying enormous commercial value.
• Human resources and benefits consulting firms, which hold employee records, compensation data, and health benefit information across multiple employer clients simultaneously.

The common thread is custody. These firms are custodians of data that belongs to others. That custodial relationship is what makes the ransom economics work for attackers. The firm pays not just to recover its own operations, but to avoid the secondary obligation of notifying every client whose data was exposed. It is precisely this dynamic that explains why ransomware targets professional services firms at disproportionate rates compared to other small business sectors.

Why the Math Works for Attackers When Ransomware Targets Professional Services Firms

Ransomware is a business. Attackers conduct due diligence before they deploy. They profile targets, assess revenue, estimate insurance coverage, and gauge the sensitivity of the data held. When ransomware targets professional services firms, the calculus is particularly favorable, for several specific reasons.

First, data density is high relative to firm size. A six-person accounting firm might hold complete financial records for 200 business clients and 1,500 individual tax filers. The attack surface is small — six endpoints, one file server, one email domain — but the data payload is enormous. The attacker does not need to breach a large organization to gain large-organization-level leverage.

Second, security investment is typically mismatched to data risk. Many professional services firms under 50 employees still run consumer-grade endpoint protection, with no tested backup strategy, no multi-factor authentication on file access systems, and no documented incident response plan. The IC3 report found that firms in this size band were significantly more likely to pay a ransom than larger enterprises — both because they lacked recovery capabilities and because they lacked the internal infrastructure to contain damage quickly.

Third, regulatory notification obligations create a second layer of leverage. A firm that gets hit faces not just operational disruption but the prospect of notifying every client whose data was exposed under state breach notification laws, FTC Safeguards Rules (which now apply explicitly to non-bank financial institutions including accounting firms and financial advisors), and in some cases HIPAA if the firm handles any health-adjacent data. When notification, legal counsel, credit monitoring, and reputational damage are factored in, the total cost of a breach can dwarf the ransom demand itself.

The FTC Safeguards Rule, updated in 2023, now requires accounting firms, tax preparers, and financial advisors that qualify as “financial institutions” under the Gramm-Leach-Bliley Act to maintain a formal written information security program, designate a qualified individual to oversee it, and conduct regular risk assessments. Many small firms are not yet compliant. CISA and the FBI have both noted in joint advisories that attackers are aware of this gap and use it as a secondary threat in ransom negotiations: pay, or we notify your regulators about the breach. This regulatory exposure is another key reason ransomware targets professional services firms so aggressively.

Real Incidents: What Attacks on These Firms Look Like

Federal data does not typically name victims in individual incidents, but documented case patterns and publicly reported incidents from 2023 through early 2025 paint a clear picture of how attacks unfold when ransomware targets professional services firms.

The most common initial access vectors for attacks on professional services firms, as documented in CISA and FBI joint advisories, include:

• Phishing emails that impersonate a known client, vendor, or tax authority and deliver a credential-harvesting link or attachment. Accounting firms are especially exposed during tax season, when volume is high and urgency is normalized.
• Exploitation of exposed remote desktop connections. Many small professional services firms still use remote desktop to let staff or owners work from home, without adequate authentication controls on those connections.
• Compromised credentials purchased from criminal marketplaces. Attackers buy stolen usernames and passwords and test them against a firm’s email and file-sharing systems.
• Supply chain entry through a compromised vendor or software platform. Several documented incidents involved attackers entering a professional services firm through a compromised document-sharing or practice management software provider.

Once inside, modern ransomware operators do not immediately encrypt. They spend days or weeks moving through the environment, identifying where the most valuable data lives, exfiltrating copies before encryption begins, and often deleting or corrupting backup files if those are accessible from the same network. By the time the encryption event triggers and the victim sees the ransom note, the attacker already has the leverage they need.

A documented pattern from multiple 2024 incidents where ransomware targeted professional services firms involved double extortion: the attacker both encrypted local files and threatened to publish client financial data on a public leak site unless payment was made. For firms whose business depends on client confidentiality, the publication threat often drove payment decisions more than the operational disruption did.

Defense Posture: What Actually Works Against Ransomware Targeting Professional Services Firms

The defensive controls that break the attack chain when ransomware targets professional services firms are not exotic. They are documented, repeatable, and do not require a large internal IT team. The challenge is that most small professional services firms have never had anyone implement these controls in a coherent, tested way.

Federal guidance consistently identifies these controls as highest-impact for this sector:

• Multi-factor authentication on every external-facing system — email, file access, remote access, and any cloud-hosted practice management tools. CISA is explicit: multi-factor authentication stops the majority of credential-based attacks cold.
• Offline or air-gapped backups that are not accessible from the same network segment as production systems. If a backup can be reached from an infected endpoint, it can be encrypted or deleted. A backup that has never been tested is not a backup.
• Endpoint detection that looks at behavior, not just known malware signatures. Modern ransomware is often custom-written or heavily modified to evade signature-based tools. Behavioral monitoring identifies the attack pattern regardless of whether that specific malware has been seen before.
• Email filtering that includes link analysis and attachment sandboxing. Most initial access events start in the inbox, and effective filtering dramatically reduces the volume of malicious content that reaches users.
• A documented, tested incident response plan — not a policy document in a binder, but a tested procedure that specifies who calls whom, what gets isolated first, and how the firm communicates with clients if data is confirmed to have been exposed.
• Regular, structured security awareness training for all staff, including simulated phishing exercises. The human element remains the most reliable entry point for attackers, and training that is never tested does not close that gap.

For firms subject to the FTC Safeguards Rule, these controls are not just good practice — they are regulatory requirements. The FTC has begun enforcement actions against non-bank financial institutions for inadequate data security programs, and the bar for “adequate” rises each year.

If you want a structured framework to measure where a firm stands, the Center for Internet Security’s Critical Security Controls are the most practical and widely adopted benchmark for organizations of this size. For a broader view of how these controls connect to a managed IT and cybersecurity program, the Xact IT cybersecurity services page walks through the layered approach we build for firms in exactly this risk profile. You can also explore our managed IT services to see how ongoing monitoring fits into a complete defense strategy.

What to Ask Your IT Firm Right Now

One of the most reliable ways to gauge whether your IT firm understands the specific risk profile that exists when ransomware targets professional services firms is to ask questions that expose their reasoning, not just their service catalog. Vendors selling a package will answer these questions with product names. Vendors who understand your actual exposure will answer with specific analysis of your environment.

Ask these questions:

• Where are our backups stored, and have they been successfully restored from in the last 90 days? If the answer is “in the cloud” without further specificity, or if there is no recent restore test on record, that is a gap.
• If an attacker got into our network today, how long before you would know? The answer should describe a specific detection mechanism and a documented alert process — not a general reassurance.
• Are we subject to the FTC Safeguards Rule, and if so, do we have a written information security program that meets the current requirements? If your IT firm has never raised this question, that is a meaningful signal.
• What is our incident response plan, and when did we last test it? A plan that has never been exercised is a theoretical document. Testing reveals the gaps that only show up under pressure.
• How would an attacker most likely get into our environment today? The ability to give a specific, honest answer to this question is one of the clearest indicators of a security-competent firm versus one selling reassurance.
• Do you carry cyber liability insurance, and have you reviewed our policy to confirm our security controls meet the coverage conditions? Many cyber policies have conditions around multi-factor authentication and backup practices that can void coverage if they are not satisfied.

These are not adversarial questions. They are the questions that any firm holding the volume of client data that a typical accounting or consulting practice holds should be able to answer with specificity. If the conversation turns vague, that vagueness is the answer.

If you want a second opinion on where your firm actually stands, Book a Free Cybersecurity Strategy Call. It is a 20-minute conversation with our team — no sales pressure, no obligation — focused on your specific environment and exposure.

The Bottom Line

The 2024 and 2025 federal data tells a consistent story: ransomware targets professional services firms — accountants, consultants, advisory practices, financial planners — with increasing frequency and precision. These firms have moved from the edges of the ransomware target landscape to the center of it. The economics are simple, and attacker groups understand them precisely.

High data density, lean security programs, and compounding regulatory notification obligations combine to create a leverage ratio that attackers are systematically exploiting. The reason ransomware targets professional services firms so reliably is that the data is valuable, the defenses are often thin, and the pressure to pay is intense. The firms that are not getting hit are not necessarily the ones with the largest IT budgets. They are the ones that made deliberate decisions about the specific controls that break the attack chain, implemented them coherently, and tested them.

The gap between the firms that pay ransoms and the firms that do not is mostly a gap in preparation, not resources. That is the more useful version of this story — because preparation is something that can be changed.