Article Details

Tax resolution firm Optima Tax Relief hit by ransomware, data leaked. U.S. tax resolution firm Optima Tax Relief suffered a Chaos ransomware attack, with the threat actors now leaking data stolen from the company. Optima Tax Relief is a well-known U.S. tax resolution firm that helps individuals and businesses in addressing and fixing federal and state tax issues. The company claims to be the nation’s leading tax resolution firm, having resolved over $3 billion in tax liabilities for clients. Today, the Chaos ransomware gang added Optima Tax Relief to its data leak site, claiming to have stolen 69 GB of data.  This data contains what appears to be corporate data and customer case files. Tax documents commonly contain sensitive personal information, such as Social Security numbers, phone numbers, and home addresses, which can be used for malicious activity by other threat actors or identity theft. Sources with knowledge of the attack told BleepingComputer that this was a double-extortion attack, with the threat actors not only stealing data from the company but also encrypting servers. Chaos ransomware is a relatively new ransomware operation that launched in March 2025, when it claimed five victims on its data leak site. The ransomware gang should not be confused with The Chaos ransomware builder, which has been around since 2021 and used to create a myriad of branded encryptors used in phishing and malware campaigns. Chaos ransomware also claimed to have breached the Salvation Army, which did not respond to our queries last week. BleepingComputer contacted Optima Tax Relief with questions about the attack and will update the story if we receive a response. Why IT teams are ditching manual patch management Manual patching is outdated. It's slow, error-prone, and tough to scale. Join Kandji + Tines on June 4 to see why old methods fall short. See real-world examples of how modern teams use automation to patch faster, cut risk, stay compliant, and skip the complex scripts.