Khoo and Company, Inc Listed by cicada3301 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a tax and accounting firm appears on a ransomware group's listing, the practical concern for clients is immediate and personal. Financial records, tax filings, identification details and correspondence that people entrust to professionals can become tools for fraud, identity theft or further targeting if they leave the organisation's control. On 24 July 2024, Khoo and Company, Inc was named by the group known as cicada3301, which claims to have taken internal files during a ransomware attack. The number of people whose information may be involved remains unknown, and public detail about the precise contents is limited, yet the nature of the firm's work means the stakes for individuals are concrete rather than abstract.

This report sets out only what has been reported, places the claim in context, and outlines the realistic risks and next steps for anyone who may have dealt with the firm.

Inside the incident

According to the available record, Khoo and Company, Inc was listed by the cicada3301 ransomware group on 24 July 2024. The group asserts that internal files were exfiltrated as part of a ransomware attack. No confirmed figure has been published for the number of people affected, and the public reporting does not disclose the exact date the intrusion began, how long it lasted, the initial access method, or whether encryption of systems occurred alongside the claimed data theft. The listing itself is a claim made by the group; independent confirmation of the full scope has not been supplied in the facts available here. What is stated is limited to the assertion of internal-file exfiltration and the organisation's appearance on the group's roster of victims.

In the absence of further official statements or forensic disclosures, the scale and technical details remain undisclosed. Readers should treat the group's assertions as unverified claims until corroborated by the organisation or independent investigators.

Inside cicada3301

Cicada3301 is a ransomware operation that has appeared in public reporting as a double-extortion actor: operators typically encrypt systems while also claiming to steal data, then threaten to publish or sell the material if a ransom is not paid. Like many such groups, it maintains a leak site on which it lists organisations it says it has compromised, often posting samples or full archives when negotiations stall. Public knowledge of the group indicates it has targeted a range of sectors rather than specialising exclusively in professional services, and its listings function both as pressure on the victim and as advertising of its capabilities to other potential targets. The group has been observed using standard ransomware tactics—initial access followed by lateral movement, data staging and encryption—though specific tooling and infrastructure can change over time.

Nothing in the present facts attributes unique statements by cicada3301 about Khoo and Company, Inc beyond the listing itself and the claim of internal-file exfiltration. Any broader characterisation of the group's motives or internal communications regarding this particular victim would be speculation and is therefore omitted.

Who is Khoo and Company, Inc?

Khoo and Company, Inc describes itself as a small, closely knit team of professionals focused on domestic and international taxation planning and compliance. Its members hold accounting degrees, CPA credentials or candidacy status, and some pursue or hold master's degrees in taxation. The principal is Eng Kuan Khoo, CPA. Firms of this type typically advise individuals, families and businesses on tax strategy, prepare and file returns, handle correspondence with revenue authorities, and maintain detailed records of income, deductions, assets and personal identifiers necessary for accurate compliance work.

Because the practice is small and relationship-driven, clients often share sensitive financial histories, identification documents, bank and investment details, and sometimes information about family members or business partners. A breach involving such a firm is consequential precisely because the data is concentrated, high-value for fraud, and trusted to a limited circle of professionals rather than a large corporate bureaucracy. The firm's own description emphasises personal service and specialised tax expertise; those same qualities mean the information it holds is both intimate and financially actionable.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, client lists, or specific data categories has been publicly detailed. Exact contents therefore remain unconfirmed.

Organisations engaged in tax planning and compliance customarily hold, among other materials, client contact information, Social Security or taxpayer identification numbers, income and expense records, prior-year returns, bank and brokerage statements, correspondence with tax authorities, and notes on planning strategies. They may also retain engagement letters, internal workpapers and credentials used to access client portals or government systems. Whether any of these categories were among the files claimed by cicada3301 is not established in the available record. Readers should not assume particular documents were or were not taken; the only confirmed assertion is the group's claim of internal-file exfiltration.

What's at stake

For individuals whose data may have been involved, the primary risks are identity theft, tax-related fraud and secondary social-engineering attacks. Stolen tax records can be used to file fraudulent returns, open credit accounts, or craft highly convincing phishing messages that reference real financial details. Even partial files—names, addresses, account numbers or prior correspondence—can lower the barrier for such misuse. Because tax data often spans multiple years, the window of usefulness to criminals can be long.

For the firm itself, the consequences include potential regulatory notification duties, reputational harm among a client base that values confidentiality, possible legal exposure if negligence is later alleged, and the operational cost of investigation, remediation and client support. The facts do not establish that the organisation was negligent; they simply record a listing and a claim of data theft. Both clients and the firm face uncertainty until fuller disclosure occurs.

In practical terms, affected people may need to monitor credit reports, tax transcripts and account activity for unusual activity, and to treat unsolicited communications that reference tax matters with heightened caution. The organisation may need to notify clients, regulators and insurers according to applicable law, though the timeline and content of any such notices are not part of the present facts.

Were you affected?

If you have been a client of Khoo and Company, Inc or have shared tax or financial documents with the firm, treat the possibility of exposure seriously even though the number of people affected remains unknown. Begin by reviewing recent account statements, tax transcripts and credit reports for unfamiliar activity. Consider placing fraud alerts or credit freezes with the major bureaus, and be wary of emails, calls or messages that claim to relate to your taxes or to this incident. Change passwords on any portals or email accounts that may have been used in correspondence with the firm, and enable multi-factor authentication where available.

Because public detail is limited, the most reliable early indicator for many people is whether their email address or other identifiers have already appeared in known breach data sets. Readers can run a free exposure scan of their email to check whether their information has surfaced in previously documented breaches; such a check does not prove or disprove involvement in this specific incident, but it provides a practical starting point for personal monitoring. Stay alert for any official notification from the firm itself, and rely on verified channels rather than unsolicited contact claiming to offer remediation.

AICompiled with AI assistance from public sources and published under our editorial standards.