SmithDunn&Co Listed by Space Bears Ransomware Group

On December 31, 2024, tax preparation firm SmithDunn&Co appeared on the leak site of the spacebears ransomware group. The company, which provides individual and business tax services, e-filing, and related support, had internal files, client documents, databases from Drake Software and QuickBooks, and other sensitive information exfiltrated.

What Public Reporting Shows

Public reporting indicates the attackers listed SmithDunn&Co on their dark web leak page and posted samples of the stolen material. The data categories include client files, company documents, and databases containing tax preparation records. No exact victim count has been disclosed, and the precise volume of records remains unclear. The listing appeared on the final day of 2024, consistent with the group’s pattern of publicizing victims after an initial intrusion and exfiltration window.

Why This Matters for You and Your Family

If you or anyone in your household used SmithDunn&Co for tax preparation, your personal financial records, Social Security numbers, addresses, and income details may now sit in a ransomware operator’s hands. Tax data is especially dangerous because it remains valuable for years; thieves can file fraudulent returns, open accounts, or combine it with other leaks to build a complete profile of your family. Children’s information sometimes appears in family tax filings, creating long-term exposure that can follow them into adulthood.

The Doxxing and Identity-Chain Risks

Stolen tax files frequently contain email addresses, phone numbers, and employer details that link your online handles to your real identity. Once attackers or data resellers possess these connections, a single leak can cascade into doxxing campaigns, SIM-swapping attempts, or targeted phishing. Credential leaks of this nature often spread to gaming platforms, where children’s accounts become entry points for further harassment or extortion. Identity-chain mapping becomes critical because one exposed tax record can unlock dozens of other accounts that reuse the same contact information.

Spacebears Group Track Record

Public reporting attributes the spacebears ransomware operation to a group that emerged in 2024. The actors typically gain initial access through phishing or exploited remote desktop services, exfiltrate sensitive files before encryption, and then publish samples on their leak site when victims refuse to pay. Notable prior victims include other small and mid-sized professional services firms. Their playbook emphasizes steady pressure through partial data dumps rather than immediate mass publication, aiming to force negotiation.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the SmithDunn&Co breach.
• Rotate any password you used at SmithDunn&Co anywhere else it is reused and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become targets when tax data links names and addresses to usernames.
• Let remediation specialists handle takedown requests for any exposed personal documents that surface on data broker sites or forums.

Tax season heightens the risk that stolen records will be actively exploited. Acting quickly on the exposure while it is still fresh gives you the best chance to limit damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real people, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that frequently chain back to the same leaked addresses.