Smoll & Banning, CPAs Listed by rhysida Ransomware Group

On November 18, 2025, the accounting firm Smoll & Banning, CPAs in Dodge City, Kansas, appeared on the public leak site of the rhysida ransomware group. The firm’s internal files were allegedly exfiltrated during a ransomware attack, and anyone whose tax returns, financial statements, Social Security numbers, or other personal documents passed through the firm may now have their information exposed.

What's Publicly Reported from Reporting

Public reporting indicates that Smoll & Banning, CPAs, LLC, an independent accounting firm, had data stolen in a ransomware incident. The rhysida group posted proof of the exfiltration on its leak site, listing the company as a victim. Available reporting describes the exposed material as internal files; the exact number of individuals affected remains unknown. No specific deadline for ransom payment has been publicly detailed in the listing, but ransomware groups typically set short windows before releasing more data.

Why This Matters for You and Your Family

If you or anyone in your household used Smoll & Banning for tax preparation, bookkeeping, payroll, or estate planning, your sensitive financial and identity information may be in the hands of criminals. Tax returns, bank account details, Social Security numbers, and client correspondence are common targets because they provide everything needed for identity theft, fraudulent loan applications, or tax-refund fraud. Your family’s financial stability can be disrupted long after the initial breach, with thieves quietly using stolen data for months or years.

Ordinary families rarely realize their accountant’s systems were breached until fraudulent activity appears on credit reports or tax transcripts. By then the damage is already underway.

The Doxxing and Identity-Chain Implications

Stolen accounting files rarely stay isolated. Criminals combine them with username and password pairs from earlier breaches to create detailed identity chains. A single leaked tax document can link your name, address, date of birth, and employer to email accounts, phone numbers, and online handles. Once those connections are mapped, attackers can target your email for reset codes, your bank for wire fraud, or your children’s gaming accounts that reuse the same passwords. Credential leaks like this one frequently cascade into account takeovers and doxxing chains that expose family members who never interacted with the firm.

Rhysida’s Publicly Known Track Record

Public reporting attributes the attack to the rhysida ransomware group. The group emerged in 2023 and has since claimed responsibility for incidents against healthcare providers, educational institutions, and professional services firms. Its typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by exfiltration of sensitive files and deployment of ransomware. Rhysida then demands payment and, if unpaid, publishes samples or full datasets on its leak site to pressure victims. The group’s operations have been documented by multiple cybersecurity researchers tracking ransomware activity since its first notable campaigns.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the Smoll & Banning breach.
• Rotate every password you used at Smoll & Banning anywhere it has been reused, then enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into takeovers.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The incident underscores that even local professional firms can become gateways to widespread identity exposure. Taking deliberate steps now limits how far criminals can travel down the identity chain created by this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your family’s digital footprint.