Alleged Chaos ransomware attack hits Optima Tax Relief

The alleged Chaos ransomware campaign has targeted U.S. tax resolution firm Optima Tax Relief. Threat actors are leaking stolen data online following a double-extortion scheme.

Optima Tax Relief is a prominent firm that assists individuals and businesses in resolving federal and state tax issues. The company claims to be the nation’s leading tax resolution provider, addressing over $3 billion in tax liabilities.

According to sources familiar with the incident, Chaos ransomware operators claim to have exfiltrated 69 GB of data, now listed on their data leak site.

Moreover, the stolen files reportedly include corporate information and sensitive customer case files. Researchers noted that tax documents often contain Social Security numbers, home addresses, and phone numbers. Hence, attackers could exploit this potentially exposed data for identity theft or other malicious purposes.

The incident is described as a double-extortion attack, in which the threat actors both encrypted company servers and stole sensitive data to pressure the victim into paying a ransom.

 

The Chaos ransomware group is an up-and-coming cybercriminal organisation.

 

Chaos ransomware is a relatively new operation that first surfaced in March 2025. Researchers emphasised that it should not be confused with the Chaos ransomware builder since it is a separate malware toolkit used in phishing campaigns since 2021.

In addition to Optima Tax Relief, the Chaos gang has claimed responsibility for breaches of other organisations, such as the Salvation Army.

These attacks show a growing trend in which mid-sized companies, particularly those handling sensitive financial data, become attractive targets due to comparatively weaker cyber defences.

Therefore, researchers warn that firms in the tax and financial services sector must take such incidents as a signal to reassess their security frameworks, invest in employee training, and deploy real-time threat detection tools.

Optima Tax Relief has been contacted for comment. If a response is received, updates will follow.