torrescpa.com Listed by Black Basta Ransomware Group

On October 30, 2023, the accounting firm Torres CPA Group (also known as TCG) was listed on the leak site of the Black Basta ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The firm, founded in 1981 by CPA William Torres, serves clients with tax, audit, and advisory services across national and international affiliations. Anyone whose financial or personal documents were handled by the firm may now be at risk.

Reported Details from the Listing

The Black Basta leak site entry for torrescpa.com states that the attackers successfully exfiltrated internal files. The disclosure does not quantify how many records were taken, list specific data types exposed, or reveal any ransom demand. It simply states that data was stolen and gives the company a short window to negotiate before samples or full archives are published. No client names, Social Security numbers, or financial statements are openly displayed on the page, but the threat of full publication remains active.

October 30, 2023 marks the first public disclosure of the incident through the ransomware group’s own channel. The listing remains accessible via the Tor onion link, a standard practice for Black Basta to pressure victims into payment.

Why This Matters for You and Your Family

If you or anyone in your household has used Torres CPA Group for tax preparation, bookkeeping, payroll, or business advisory services, your sensitive financial information may have been taken. Tax returns, bank account details, income statements, and correspondence often contain everything needed to commit identity theft or fraudulent loan applications. Children listed as dependents on those returns are also exposed, creating long-term risks that can follow them into adulthood. Even if you are not a current client, past engagements dating back years could still be part of the stolen archive.

Accounting firms hold some of the most complete pictures of a person’s life — addresses, dates of birth, employer information, and full financial histories. A breach at this level therefore touches not only the business owner but every employee, client, and family member whose records passed through the firm.

Doxxing and Identity-Chain Implications

Stolen internal files rarely stay isolated. Attackers and subsequent data resellers combine them with other breaches to build detailed identity chains. An email address found in the Torres CPA data can be linked to gaming accounts, social-media handles, or school records. Once those connections are mapped, targeted doxxing, SIM-swapping, or spear-phishing attacks become far easier. Credential leaks of this nature frequently cascade into account takeovers on platforms that reuse the same passwords or security questions derived from tax documents.

Children’s gaming accounts are especially vulnerable because parents often use family email addresses or phone numbers that appear in CPA records. A single breach can therefore expose an entire household’s digital footprint.

Black Basta’s Known Track Record

Public reporting attributes the emergence of Black Basta to early 2022. The group rapidly gained notoriety for double-extortion tactics: encrypting victim networks while simultaneously exfiltrating data to be used as leverage. Notable prior victims include large manufacturers, healthcare providers, and professional-services firms. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by lateral movement, data theft, and then publication on their leak site if ransom is not paid. The group operates a leak site that is updated frequently, and they have consistently followed through on publishing data when victims refuse to negotiate.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Torres CPA breach.
• Rotate any password used at torrescpa.com or related services anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails found in CPA records.
• Let remediation specialists handle data-broker takedown requests and opt-out processes on your behalf so you do not have to chase every site manually.

The Torres CPA Group breach is a reminder that even established local firms with decades of operation can fall victim to sophisticated ransomware operators. Taking deliberate steps now can limit how far the stolen data travels. Start your DoxxScan trial and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage give you and your family ongoing protection against both this incident and the ones that will inevitably follow.