Security Experts:

Connect with us

Hi, what are you looking for?



HR Services Firm ComplyRight Suffers Data Breach

Florida-based HR services provider ComplyRight revealed recently that its tax reporting platform was involved in a cybersecurity incident that resulted in the exposure of personal information.

Florida-based HR services provider ComplyRight revealed recently that its tax reporting platform was involved in a cybersecurity incident that resulted in the exposure of personal information.

ComplyRight learned on May 22 that someone had gained unauthorized access to its web-based tax reporting platform, which is used by various websites to prepare W-2, 1099 and other tax-related forms.

ComplyRight, which is owned by marketing company Taylor Corporation, provides tax solutions through efile4Biz. The efile4Biz website claims its services are used by 76,000 organizations.ComplyRight hacked

However, ComplyRight says the data breach has only impacted less than 10 percent of the individuals whose tax forms have been prepared on its platform.

An investigation conducted by the company showed that the attacker gained access to the names, addresses, phone numbers, email addresses, and Social Security numbers of individual tax form recipients. However, ComplyRight has not been able to determine whether the compromised information was actually downloaded by the unauthorized party, and says it has not seen any evidence of fraud as a direct result of the incident.

Affected individuals are being notified by mail and offered 12 months of free credit monitoring and identity theft protection services.

Security blogger Brian Krebs reported that some of the recipients of these letters were unaware of ComplyRight. The company clarified that its platform is used by various tax form preparation websites whose customers are impacted by the breach and many may not be familiar with the ComplyRight brand.

According to Krebs, the attackers had access to ComplyRight systems between April 20, 2018 and May 22, 2018.

“Upon learning of the issue, we disabled the platform, remediated the issue on the website, and commenced a prompt and thorough investigation using external cybersecurity professionals to determine who was potentially affected and what information was accessed or viewed,” ComplyRight stated. “Although the investigation determined the information was accessed and/or viewed, it could not confirm if the information was downloaded or otherwise acquired by an unauthorized user.”

ComplyRight is not the only HR services firm hit by a data breach recently. Australia-based PageUp reported last month that hackers may have gained access to names, contact information, usernames, and password hashes. PageUp says it has 2.6 million active users across over 190 countries.

Related: German Hosting Firm DomainFactory Hacked

Related: Flight Tracker Flightradar24 Hit by Data Breach

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.