thedonovancompany.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continued through late 2022 to publish claims against professional-services firms, treating accounting and tax practices as high-value targets because of the sensitive client records they hold. In that climate, a listing that appeared on 22 December 2022 drew attention to a small California CPA practice.

Public reporting states that thedonovancompany.com was named by the LockBit3 ransomware group, which claimed to have exfiltrated internal files. The number of people affected remains unknown, and independent confirmation of the claim has not been published. For clients and contacts of a firm that handles tax and accounting work, even an unverified listing raises practical questions about what may have left the organisation’s systems.

Inside the incident

According to the available record, thedonovancompany.com was listed by LockBit3 on 22 December 2022. The group’s claim describes internal files exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of individuals whose information may be involved, or the precise date the intrusion began. Method of initial access, dwell time, and whether encryption was also deployed are undisclosed. The listing itself constitutes the group’s assertion; it has not been independently verified in the material provided.

What is known is limited to the organisation’s identification, the reporting date, the attribution to LockBit3, and the description of the material as internal files taken during a ransomware incident. Beyond those points, public detail is sparse.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has operated as a ransomware-as-a-service model, recruiting affiliates who conduct intrusions and share proceeds with the core group. The brand is known for maintaining a public leak site on which it names organisations it claims to have compromised, often posting samples or larger archives when ransom demands are not met. Typical tactics associated with the group and its affiliates include exploitation of exposed remote-access services, stolen credentials, and living-off-the-land techniques once inside a network, followed by data theft and, in many cases, encryption.

Prior public activity has included claims against a wide range of sectors, among them professional services, manufacturing, and government-adjacent entities. The group’s leak-site postings are claims made by the actors themselves; they are not independent confirmation that every named organisation suffered the full scope of impact described. In this instance, the record simply notes that thedonovancompany.com appeared on the LockBit3 listing with an assertion that internal files had been exfiltrated.

About thedonovancompany.com

Public description of the organisation identifies it as a small boutique CPA firm based in Irvine, California. It provides tax and accounting services to individuals and their businesses, including hands-on assistance with tax planning, tax compliance, and related matters. Firms of this type routinely maintain detailed financial records, tax returns, supporting schedules, correspondence, and identifying information necessary to prepare filings and advise clients.

A breach claim against such a practice is consequential because the data typically held is both personal and financially sensitive. Clients entrust CPAs with material that can be reused for identity theft, tax fraud, or further social-engineering attacks. Even when the exact contents of an alleged exfiltration remain unconfirmed, the nature of the sector means any successful theft of internal files carries elevated risk for the people whose records are stored there.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, client names, or specific data elements has been disclosed in the available record. The number of people affected is listed as unknown.

Organisations of this kind ordinarily hold tax returns, workpapers, bank and income details, Social Security numbers or other government identifiers, contact information, and business financial statements. Whether any or all of those categories were present in the material LockBit3 claims to have taken is unconfirmed. Readers should treat the precise contents as unverified until more authoritative disclosure appears.

Why it matters

For individuals and business owners who have used the firm, the primary risks are misuse of financial and identity data. Tax-related information can enable fraudulent filings, refund diversion, or targeted phishing that references real account details. Internal firm files may also contain credentials, correspondence, or third-party data that extend exposure beyond the firm’s direct clients.

For the organisation, a public ransomware listing can disrupt operations, trigger notification and regulatory obligations, and erode client trust regardless of whether every claimed detail is later substantiated. Because the scale of the incident and the exact data types remain undisclosed, both the firm and potentially affected people are left to manage uncertainty rather than a fully documented inventory of what left the network.

What to do if you're exposed

If you have been a client or close contact of the firm, practical first steps reduce the chance that any exposed information is used against you.

• Review recent tax transcripts and account activity with the IRS and state tax agencies for unfamiliar filings or changes.
• Place a fraud alert or credit freeze with the major credit bureaus and monitor credit reports for new accounts.
• Treat unsolicited requests for personal or financial information with heightened caution, especially messages that reference tax or accounting matters.
• Change passwords on email and financial accounts, and enable multi-factor authentication where available.
• Retain copies of any breach notices you receive and follow the specific guidance they contain.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Remaining attentive to official communications from the firm and from tax authorities remains the most reliable way to respond as further verified detail, if any, becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.