On October 8, 2026, CISA published an advisory describing Chinese government-linked threat actors combining automated scanning with hands-on activity to steal sensitive data. Among the techniques described: a tool used for password spraying and password guessing against Microsoft Office 365 cloud accounts. CISA says the activity began at least in January 2021, so the advisory is not evidence of a newly launched campaign.
For a small law, CPA, or professional office in Goshen or the Hudson Valley, the useful takeaway is to review ordinary cloud-email and remote-access controls. The advisory concerns specific actors and investigations; it does not report an incident at a local office or say that Hudson Valley firms are being targeted.
What CISA described
CISA’s report covers activity attributed to Chinese government-linked threat actors and enabled by Integrity Technology Group. It describes several methods, including automated scanning and account attacks. In the section on Microsoft Office 365, CISA says the actors used EBurst to attempt password spraying and password guessing against email accounts.
That is a reason to verify that defenses are in place—not a reason to assume your firm has been attacked. The advisory’s observations span years and multiple victims. It does not identify a local law firm, CPA practice, or small business in the Hudson Valley.
Five sensible checks for a small office
CISA’s mitigation list includes controls that can be translated into a short review with the person responsible for your IT:
- Confirm multifactor authentication is required for cloud email and remote access, including VPNs, wherever your systems support it. Check for exceptions and special accounts with your IT provider.
- Review who has administrator privileges and which connected applications can reach email or file data. Remove access that is no longer needed; ask your provider how cloud sign-ins and app access are monitored.
- Disable unused remote-access, file-sharing, and other externally reachable services—but have the provider confirm what is safe to turn off before changing a production system.
- Check that internet-facing devices and business software are supported and receiving security updates. Agree who owns patching and how you will hear about systems that cannot be updated.
- Replace any factory-default passwords still in use, and review the access controls on accounts that can reach client or financial records.
These are routine maintenance steps, not a complete security program or a guarantee against compromise. CISA’s advisory includes additional technical mitigations for larger or more complex environments; a small office should select controls that fit its systems and have changes scoped by someone authorized to manage them.
Turn the review into a written action list
For each check, record the system, the person responsible, what was confirmed, and any follow-up date. If an account, remote-access tool, or business application is no longer needed, arrange its removal through the responsible administrator rather than changing access ad hoc.
If you want a scoped baseline review, FIX256’s Remote IT Assessment page currently describes a fully remote assessment for organizations with up to 25 users. The published $299 rate is valid for 30 days after the intro call and includes written findings, prioritized next steps, and a 30-minute review call. Penetration testing, compliance certification, remediation, and onsite work are excluded; review the page for the current terms.
For a CPA or tax practice documenting its own written information-security plan, FIX256’s CPA & Tax Firm WISP Kit page currently lists an editable DOCX, matching PDF, and README for a one-time $59 purchase. It is a fill-in starting point, not a compliance guarantee, and FIX256 says the kit is not affiliated with or endorsed by the IRS or FTC.
This post is general information, not legal, tax, accounting, or compliance advice. Ask a qualified professional about your firm’s own obligations and security needs.