In today’s digital economy, an accountancy practice’s greatest asset is its data – and increasingly, its greatest vulnerability. Irish accountancy firms sit at the intersection of finance, payroll, tax, and personal information, making them uniquely attractive targets for modern cybercriminals. As Liam Lynch highlighted in his recent webinar Fortifying the Firm: Navigating Modern Cyber Threats & GDPR, the threat landscape has changed fundamentally. This is no longer about the occasional virus or a poorly written phishing email. It is about organised criminal enterprises, sophisticated social engineering, and targeted attacks designed to exploit both technology and human behaviour.

Why Irish Accountants Are Prime Targets

Accountancy practices hold what cybercriminals consider “the crown jewels”:

• Client financial records and bank details
• Payroll data, PPS numbers, and dates of birth
• Addresses, contact details, and identity data
• Commercially sensitive information such as mergers, acquisitions, and audit findings

This concentration of high-value data makes even small and medium-sized practices attractive targets. Criminals no longer cast wide nets; they research firms, identify decision-makers, and tailor attacks to specific roles within the organisation. The result is a shift from random attacks to deliberate, strategic targeting of Irish accountants.

Ransomware: Still the Dominant Threat

Ransomware remains one of the most disruptive threats facing professional services firms. While many practices associate ransomware with high-profile incidents like the HSE attack, the reality is that private firms are hit far more frequently – often quietly and without media attention.

Modern ransomware attacks no longer simply encrypt data and demand payment. Instead, attackers now:

Gain access to systems and remain undetected for weeks

Identify and exfiltrate sensitive client and firm data

Encrypt systems to cause operational shutdown

Demand payment not only to restore systems, but to prevent public data leaks

Critically, paying the ransom offers no guarantees. As highlighted in the webinar, a significant proportion of firms that paid still saw their data leaked or found that recovery keys failed, forcing them to rebuild systems anyway . For an accountancy practice, this can mean prolonged downtime, regulatory exposure, reputational damage, and loss of client trust.

Business Email Compromise: The Silent Drain

If ransomware is the blunt instrument, Business Email Compromise (BEC) is the scalpel. These attacks exploit trust, familiarity, and routine. By compromising an email account – often through convincing phishing emails – criminals can quietly observe internal and external communications for weeks.

Once embedded, attackers:

Monitor invoice and payment workflows

Alter IBANs on legitimate invoices

Impersonate partners, directors, or clients

Create urgency around “last-minute” or “confidential” payments

Because these emails come from genuine accounts and reference real conversations, they are extraordinarily difficult to detect. For accountancy practices handling client payments or internal transfers, the financial and reputational impact can be immediate and severe.

The Human Firewall: Your First and Last Line of Defence

Technology alone cannot solve this problem. As Liam Lynch emphasised, cybercriminals overwhelmingly target people, not systems. Social engineering attacks deliberately trigger fear, urgency, curiosity, helpfulness, or authority to bypass rational decision-making.

Common manipulation techniques include:

“Your account will be suspended today”

“Urgent payment required before close of business”

“A colleague shared a document/video with you”

“The CEO needs this handled discreetly”

Irish data shows that the vast majority of adults are targeted monthly by scam texts, calls, or emails, with mobile devices now the primary attack vector. This makes staff awareness, scepticism, and verification procedures essential controls, not optional extras.

AI, Deepfakes, and the Reality Behind the Hype

AI-assisted scams are real, but they are often misunderstood. While sensational headlines suggest widespread AI-driven hacking, the practical risk lies in voice impersonation, spoofed calls, and increasingly convincing social engineering.

The webinar demonstrated how AI can clone voices or faces with minimal public data, making phone calls or video meetings appear authentic. While still relatively rare, the technology exists and will inevitably be used more frequently. The defence remains the same: verification through trusted, independent channels, not blind trust in what appears familiar.

GDPR: Cyber Incidents Are Data Breaches

For Irish accountancy practices, cyber incidents are not just IT problems – they are GDPR events. Under GDPR, a data breach includes:

Loss or destruction of data

Encryption or corruption through ransomware

Unauthorised access or disclosure

Accidental mis-sending of personal data

This means a ransomware attack, even without confirmed data exfiltration, may still constitute a reportable breach. Firms must assess risk quickly and, where required, notify the Data Protection Commission within 72 hours of becoming aware of the incident.

The consequences of non-compliance can be severe, including regulatory fines, mandatory corrective actions, and lasting reputational harm – particularly damaging in a profession built on trust and confidentiality.

From Awareness to Resilience

The core message of Fortifying the Firm is not fear, but preparedness. Irish accountancy practices must assume they are targets and act accordingly. This means:

Treating cybersecurity as a business risk, not an IT issue

Training staff to recognise manipulation and pause before reacting

Enforcing verification for payment and data requests

Using strong passwords, password managers, and multi-factor authentication

Maintaining tested backups and incident response plans

By strengthening both technical controls and human awareness, firms can move from uncertainty to resilience – protecting not just data, but their reputation, regulatory standing, and client trust in an increasingly hostile digital environment.

Cybersecurity & GDPR FAQs for Irish Accountancy Practices

1. Why are Irish accountancy practices being targeted by cybercriminals?

Accountancy practices hold large volumes of highly valuable data in one place — financial records, payroll data, PPS numbers, bank details, and commercially sensitive information. Cybercriminals see this as “high-value, low-resistance” data, particularly in small and medium-sized firms that may not have dedicated cybersecurity teams.

2. Are cyberattacks still mainly about viruses and phishing emails?

No. While phishing still exists, modern attacks are far more sophisticated. Today’s threats include ransomware combined with data theft, business email compromise, social engineering, and increasingly convincing impersonation tactics. Many attacks involve criminals quietly observing systems for weeks before acting.

3. What is ransomware, and why is it so damaging for accountancy firms?

Ransomware is malicious software that encrypts your data and systems, effectively shutting down operations. Modern ransomware attacks also involve stealing data first, then threatening to publish it if payment is not made. For accountancy practices, this can mean operational paralysis, GDPR exposure, reputational damage, and loss of client trust.

4. If a firm pays the ransom, does that solve the problem?

No guarantee. Many firms that pay still:

• Have data leaked anyway
• Fail to recover systems fully
• Need to rebuild IT infrastructure
• Are targeted again by the same attackers

Paying a ransom does not remove the underlying compromise.

5. What is Business Email Compromise (BEC)?

BEC occurs when criminals gain access to a legitimate email account within a firm. They then monitor emails, impersonate trusted individuals, change IBANs on invoices, or issue urgent payment requests. Because the emails come from real accounts, they are extremely difficult to detect.

6. How do attackers usually gain access to email accounts?

Most commonly through social engineering:

• Fake “secure document” emails
• Malicious login pages that look like Microsoft or Google
• Trick messages asking users to re-authenticate

Once credentials are captured, criminals can log in from anywhere unless multi-factor authentication is in place.

7. Is technology alone enough to protect a firm?

No. Liam emphasised that people are the primary attack surface. Even the best technology can be bypassed if someone clicks a link, installs software, or acts under pressure. Staff awareness, verification processes, and firm-wide policies are critical.

8. What is meant by the “human firewall”?

The human firewall refers to staff who:

• Question unexpected requests
• Pause when pressured
• Verify payment or data requests
• Recognise emotional manipulation

Training people to recognise social engineering is one of the most effective security measures a firm can adopt.

9. Are AI-powered scams and deepfakes a real threat?

The technology exists, but much media coverage is exaggerated. AI can be used to impersonate voices or faces, but the real risk remains trust without verification. Firms should not rely on recognising voices or faces alone — all payment or data requests should be independently verified.

10. What is spoofing, and why is it dangerous?

Spoofing is when criminals make emails, phone calls, or texts appear to come from trusted sources (banks, colleagues, IT providers). Numbers and sender names can be faked. This is why firms should hang up and call back using trusted contact details, not those provided in the message.

11. Are scam text messages (smishing) still a problem?

Yes. Text messages remain a major attack vector because they historically lacked strong security controls. Criminals impersonate delivery companies, banks, Revenue, and utilities, often including links designed to steal credentials or payment details.

12. Is clicking a link in a text message risky?

Yes. As a general rule, links in unsolicited text messages should never be clicked. If a message appears to come from a legitimate organisation, access the service by typing the website address manually or using a trusted app.

13. What passwords practices did Liam recommend?

• Never reuse passwords
• Use long passwords (15+ characters)
• Use a password manager to generate and store passwords
• Avoid browser-based password storage where possible

Password length matters far more than complexity.

14. What is multi-factor authentication (MFA), and why is it important?

MFA adds an extra layer of protection beyond a password, such as:

• App-based codes
• Push notifications
• Hardware security keys

Even if a password is stolen, MFA can prevent account access. Email accounts should always have MFA enabled.

15. What are hardware security keys, and who should use them?

Hardware security keys (e.g. YubiKeys) are physical devices used to authenticate logins. They offer the highest level of protection and are recommended for:

• Partners
• Directors
• Staff involved in payments or sensitive data

They are extremely resistant to phishing and account takeover.

16. Is a ransomware incident considered a GDPR data breach?

Yes. Under GDPR, a data breach includes loss, destruction, corruption, or unauthorised access to personal data. Even if data is “only” encrypted and not leaked, it may still be a reportable breach.

17. What are a firm’s GDPR obligations after a cyber incident?

Firms must:

• Assess the risk to individuals
• Notify the Data Protection Commission within 72 hours if required
• Notify affected individuals if there is a high risk to them
• Keep records of the incident and response

Failure to act appropriately can lead to fines and enforcement action.

18. Should firms upload client data into AI tools like ChatGPT?

No. Public AI tools should not be used with personal or client data. Doing so may constitute a data breach, as firms cannot control where that data is stored or reused.

19. What is an incident response plan, and why is it important?

An incident response plan outlines:

• Who does what during an incident
• How systems are isolated and recovered
• How evidence is preserved
• How regulators and stakeholders are notified

Having a plan reduces panic, limits damage, and ensures GDPR obligations are met.

20. What is the single most important takeaway for accountancy practices?

Cybersecurity is no longer just an IT issue. It is a business risk, compliance issue, and trust issue. Firms that combine strong technical controls with trained, sceptical staff are far better positioned to protect their clients, their reputation, and their future.

The contents of this article are meant as a guide only and are not a substitute for professional advice. The authors accept no responsibility for any action taken, or refrained from, as a result of the material contained in this document. Specific advice should be obtained before acting or refraining from acting, in connection with the matters dealt with in this article.