PHG CPAs (bushman.biz) Listed by lynx Ransomware Group

On November 24, 2024, Prince Hansen Group, PLLC (operating as PHG CPAs and bushman.biz), a Salt Lake City-based accounting firm, was listed on the leak site of the lynx Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack. The firm, which serves more than 1,700 clients with tax preparation, financial planning, payroll, business valuation, and wealth management services, has not publicly quantified the number of affected individuals or the exact volume of data involved.

Reported Details from the Listing

The lynx leak site entry states that PHG CPAs suffered a ransomware incident in which attackers successfully exfiltrated internal files. The disclosure does not specify the precise data types taken, the total number of records, or any ransom demand. It simply lists the victim under the group’s public shaming portal, a common tactic used to pressure companies into payment. Public reporting on lynx indicates the group typically posts proof of compromise and offers to sell or publish stolen data if demands are not met.

Why This Matters for You and Your Family

If you or any member of your family has used PHG CPAs for tax returns, payroll processing, wealth management, or business financial services, your personal and financial information may have been exposed. Tax documents, Social Security numbers, bank account details, and income records are common in CPA environments even when exact contents are not disclosed. A breach at a firm handling 1,700 clients means ordinary individuals and small-business owners now face heightened risk of identity theft, fraudulent tax filings, and unauthorized access to accounts. The incident underscores that even regional service providers trusted with sensitive family finances can become targets, directly affecting everyday people rather than only large corporations.

Doxxing and Identity-Chain Risks

Stolen internal files from a CPA firm rarely exist in isolation. Attackers can combine client lists, correspondence, and financial spreadsheets with other publicly available data to build detailed profiles. This creates doxxing chains that link your name, address, phone number, email, and financial history. Once assembled, these profiles are sold on underground forums or used to launch targeted phishing, SIM-swapping, or tax-refund fraud. Credential leaks that surface in such incidents frequently cascade into account takeovers, including gaming platforms used by children and teenagers. A single exposed email and password from a parent’s CPA file can lead to compromise of a child’s Roblox, Fortnite, or Discord account, further expanding the household attack surface.

Lynx Ransomware Group Track Record

Public reporting attributes the emergence of lynx to mid-2024. The group has claimed responsibility for attacks on various organizations, focusing primarily on small-to-medium businesses and professional service firms. Their typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by exfiltration of sensitive files before deploying ransomware. Rather than solely encrypting systems, lynx emphasizes double-extortion: threatening both data encryption and public release of stolen documents. The group maintains an active leak site where it posts victim names and sample data to increase pressure. While exact success rates remain unclear, public trackers show lynx consistently follows through on publishing files when victims do not pay.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you ever used at PHG CPAs or bushman.biz wherever it has been reused, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists manage takedown requests for any exposed personal documents appearing on data broker sites or underground forums.

The listing of PHG CPAs on the lynx leak site is a reminder that professional service providers remain attractive targets and that ordinary families bear the downstream consequences. Starting proactive defense now can limit the long-term impact of this and future incidents. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.