tdunhamcpa.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have shared tax returns, payroll records, financial statements or personal identification with a local accounting practice may now face the possibility that those materials have been taken by criminals. When a ransomware group lists a firm like tdunhamcpa.com, the practical concern is straightforward: sensitive financial and personal data that clients trusted to a certified public accountant could be circulating outside the firm’s control, creating risks of identity theft, tax fraud or further social-engineering attacks.

Public reporting indicates that the website of Tracy Dunham, CPA, was named on a leak site operated by the safepay ransomware group on or around 26 May 2025. The number of individuals affected remains unknown, and the precise contents of any stolen material have not been independently verified. What is known is limited to the group’s claim that internal files were exfiltrated during a ransomware attack.

What happened

According to available records, tdunhamcpa.com was listed by the safepay ransomware group on 26 May 2025. The listing asserts that internal files belonging to the firm were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access method, the date of intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public summary. The number of people whose information may be involved is listed as unknown. Because the information originates from a criminal leak site, the claim that data was stolen remains unverified by independent sources at the time of reporting.

The group behind it: safepay

Safepay is a ransomware operation that became active in late 2024 and has since been observed conducting double-extortion campaigns. Like many contemporary groups, it typically encrypts victim systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a dark-web leak site where it posts the names of organisations it claims to have compromised, often accompanied by sample files or countdown timers. Safepay has targeted a range of small and mid-sized businesses across multiple sectors rather than focusing exclusively on large enterprises. Public analyses describe its operators as opportunistic, using common initial-access techniques such as phishing or exploitation of unpatched remote-access services. In this instance, the group’s listing of tdunhamcpa.com constitutes an unverified claim; no confirmation from the firm or law-enforcement sources has been included in the available facts.

About tdunhamcpa.com

tdunhamcpa.com is the online presence of Tracy Dunham, a Certified Public Accountant based in Jackson, Wyoming. The practice provides tax preparation, tax planning and representation for small-business owners, individuals, estates and trusts. Additional services include bookkeeping, payroll processing, QuickBooks consulting and financial planning. Firms of this type routinely handle highly sensitive client materials: Social Security numbers, bank-account details, income records, business ledgers, payroll data and correspondence with tax authorities. Because the relationship between a CPA and a client is built on confidentiality, any unauthorised access to those records carries particular weight for the people who rely on the firm.

What was likely exposed

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” No inventory of specific documents, file counts or categories has been published. Organisations that perform tax and bookkeeping work typically store client tax returns, supporting financial statements, payroll registers, employer identification numbers, personal identification documents and correspondence. It is therefore possible that materials of that nature were among the internal files claimed by safepay, yet the exact contents remain unconfirmed. Readers should treat any assertion about particular data elements as speculative until the firm or an independent investigation provides further detail.

What's at stake

For clients, the primary risks are identity theft, fraudulent tax filings, unauthorised access to bank or investment accounts, and targeted phishing that leverages accurate personal or financial details. Even if encryption keys are later obtained or systems restored, the mere exfiltration of data means the information may already be in the hands of criminals who can sell or reuse it. For the firm itself, the incident raises questions of client notification, potential regulatory obligations under state data-breach laws, and the longer-term erosion of trust that can follow any compromise of confidential financial records. Because the number of affected individuals is unknown, the full scope of these consequences cannot yet be measured.

What to do if you're exposed

Anyone who has been a client of the practice should monitor tax transcripts and credit reports for unexpected activity, consider placing a fraud alert or credit freeze with the major credit bureaus, and remain alert to phishing messages that reference tax or accounting matters. Changing passwords on financial accounts and enabling multi-factor authentication where available are prudent immediate steps. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check provides one additional data point while official notifications, if any, are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.