Anders CPAs + Advisors Listed by SilentRansomGroup Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have worked with Anders CPAs + Advisors, or whose financial records may have passed through the firm, now face the practical question of whether their personal or business information was among material taken in a recent ransomware incident. Public reporting so far confirms only that the firm was listed by a known extortion group and that internal files were claimed as stolen; the number of individuals affected remains unknown, and the precise contents of those files have not been detailed. For clients, employees, and partners, that uncertainty itself is the immediate stake: financial and tax-related data held by accounting firms can be used for identity fraud, tax-return scams, or further social-engineering attacks if it has left the organisation’s control.

The listing was reported on 17 January 2025. Until Anders or independent investigators publish a fuller account, anyone connected to the firm must treat the possibility of exposure as real while recognising that many details are still unconfirmed.

Breaking down the breach

According to available public information, Anders CPAs + Advisors was listed by the ransomware group SilentRansomGroup. The report characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No official statement from the firm confirming the full scope, the exact date of intrusion, or the method of initial access has been included in the public summary. The number of people whose data may have been involved is listed as unknown. The only data category named is “internal files.” No further breakdown of file types, volume, or whether encryption of systems also occurred has been disclosed in the material provided. The incident is therefore known primarily through the group’s claim and the subsequent reporting of that claim; independent verification of the group’s assertions has not been detailed publicly.

Inside SilentRansomGroup

SilentRansomGroup is a ransomware and data-extortion actor that has operated for several years by combining network intrusion with the theft of sensitive files and the threat to publish them. Like many contemporary groups, it typically relies on double-extortion tactics: after gaining access—often through phishing, compromised credentials, or exploitation of remote-access tools—it copies data before deploying ransomware or simply demanding payment under threat of a leak-site release. The group maintains a public leak site where it posts victim names and, in some cases, sample files to pressure organisations into negotiating. Its prior activity has included professional-services firms, manufacturing companies, and other mid-sized organisations that hold concentrated stores of client or employee records. Listings on such sites are claims made by the actors themselves; they are not independent confirmations that every asserted file set was in fact stolen or that every named organisation suffered the full impact described. In this case the group claims Anders CPAs + Advisors as a victim and asserts that internal files were taken; those assertions should be treated as unverified claims until corroborated by the firm or by forensic reporting.

About Anders CPAs + Advisors

Anders CPAs + Advisors is an accounting and advisory firm founded in 1965 and headquartered in St. Louis, Missouri. As a certified public accounting practice it provides audit, tax, consulting, and related financial services to businesses and individuals. Firms of this type routinely hold tax returns, financial statements, payroll data, bank-account details, Social Security numbers or other government identifiers, and correspondence that can reveal personal or commercial circumstances. Because the firm sits at the centre of its clients’ financial reporting and compliance obligations, a compromise of its systems can affect not only the organisation itself but also the clients and employees whose records it maintains. The public summary describes the firm’s sector simply as “Accounting Services,” which aligns with the ordinary expectations of a multi-decade CPA practice.

What data was at risk

The only data category explicitly named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of those files—whether they included client tax documents, employee records, contracts, or other materials—has been released publicly. Organisations in the accounting sector typically store precisely the kinds of information that enable identity theft or financial fraud: names, addresses, dates of birth, tax identification numbers, bank details, and detailed transaction histories. Because the exact contents remain undisclosed, it is not possible to state as fact which of those categories, if any, left the firm’s control. The prudent working assumption for anyone who has been a client or employee is that sensitive personal or financial data could have been among the material the group claims to possess, pending further official clarification.

Why it matters

For individuals, the concrete risk is that stolen financial or identity data can be used to file fraudulent tax returns, open credit accounts, or craft convincing phishing messages that reference real past transactions. Even if the files are never sold or published, the mere fact that they have left the firm’s custody creates a window of vulnerability that can last years. For the organisation, the incident carries operational, legal, and reputational consequences: regulatory notification duties under state and federal privacy rules, potential contractual obligations to clients, and the cost of investigation and remediation. Because the number of people affected is still unknown, the scale of any required notifications or credit-monitoring offers cannot yet be assessed. The listing by a ransomware group also signals that the firm may face continued pressure or secondary attacks if negotiations or containment efforts are incomplete.

What to do if you're exposed

Anyone who has been a client, employee, or vendor of Anders CPAs + Advisors should monitor financial accounts and tax transcripts for unexpected activity, place a fraud alert or credit freeze with the major credit bureaus if identity documents may have been involved, and treat unsolicited requests for personal information with heightened caution. Keep records of any official notices the firm may later issue. As an additional practical step, readers can run a free exposure scan of their email address to check whether that address or associated credentials have already appeared in known breach data sets; such a check does not confirm involvement in this specific incident but can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.