ATX Website Crash?

[Lee B]

2 hours ago, BrentCPA said:

Here is another article which seems to imply it was actually ATX which which started this:

https://krebsonsecurity.com/2019/05/whats-behind-the-wolters-kluwer-tax-outage/

It wouldn't surprise me. ATX has a long history of cutting corners including using a shareware database when they rewrote the program which caused the 2012 debacle !

[Lee B]

Copied from one of the online posters to the previous link:

"One of my customers is one of CCH’s customers and he was told by their support they got hit with Mega Cortex Ransomware yesterday"

[msbaysalr]

Here is a little more info that I found:

https://blog.tekkersit.com/wolters-kluwer-hit-by-mega-cortex-ransomware

 

[bdself]

Does anyone have any updates on this?  Anyone able to e-file or use the download center?

[TaxMan5]

Are you kidding me. Still down after all this time & they won't answer any calls, just say they are having a problem, & then "goodbye", then hangup on you. Absolutely unprofessional & unacceptable. What about my Clients & additional IRS/State penalties for unpaid/filed returns. Who's taking the hit on this? What about Clients that want their refunds? MAYBE CALL "MORGAN & MORGAN" for the people, for a class action suit. They need to fess up & let their valued customers know what's going on & when it will be resolved. This problem effects peoples lives & of course, not in a good way. This is right up there with Tylenol, GM, Boeing, etc. etc. Who's taking responsibility for this & who's getting fired? 

[BulldogTom]

28 minutes ago, TaxMan5 said:

Are you kidding me. Still down after all this time & they won't answer any calls, just say they are having a problem, & then "goodbye", then hangup on you. Absolutely unprofessional & unacceptable. What about my Clients & additional IRS/State penalties for unpaid/filed returns. Who's taking the hit on this? What about Clients that want their refunds? MAYBE CALL "MORGAN & MORGAN" for the people, for a class action suit. They need to fess up & let their valued customers know what's going on & when it will be resolved. This problem effects peoples lives & of course, not in a good way. This is right up there with Tylenol, GM, Boeing, etc. etc. Who's taking responsibility for this & who's getting fired? 

Bit of an over-reaction, don't you think?   Yeah, it sucks.    But we do know that they were attacked and they are trying to get their system back up.   I have no love for ATX, but I am feeling for them right now.    Cleaning up this mess is going to be a pain, and it is important that they don't expose us to the malware that attacked them.

Tom
Modesto, CA

[Abby Normal]

1 hour ago, bdself said:

  Anyone able to e-file or use the download center?

Nope.

[Abby Normal]

More general articles about this ransomware spreading:

https://www.infosecurity-magazine.com/news/matrixthemed-ransomware-megacortex-1/

https://siliconangle.com/2019/05/06/matrix-themed-megacortex-ransomware-rapidly-spreading-across-corporate-networks/

[Lee B]

"To help mitigate the risk of infection, Sophos recommended putting any machines using RDP behind a VPN, and to employ two factor authentication (2FA) to replace all admin password"

Interesting since Microsoft has announced that it is moving away from using passwords.

I suspect we will all be moving away from passwords to 2 factor authentication or even more complicated sign on requirements.

[BrentCPA]

I do kind of appreciate the irony that they make us change our password with THEM every few months and it cannot be one that you have used in the last 10 times.  Overkill?  I always thought so.  Apparently those same protocols were not quite as rigorous internally.  I like the quote one user posted on the Krebson page:

“We take security seriously”

actually means

“We didn’t take security seriously enough.”

 

[BoSkeezer]

I just did a chat with "Chantel" using the tab on the WK page you get when trying to access the MyATX Solution Center.  She said there is no ETA that she was willing to share for when ATX services will be restored.

[BoSkeezer]

Here is part of our chat, which ATX sent me to confirm my visit:

Product: ATX  
Issue Summary: Telling me "we'll let you know" is really not an answer I can plan with. What is the ETA for restoring normal ATX functionality?  
Issue Resolution: Unfortunately, we do not have a specific timeline for when we expect service to be fully restored and we do apologize. For the latest updates, please check our corporate Facebook page and Twitter account.

[scottmcfly]

1 hour ago, BoSkeezer said:

Here is part of our chat, which ATX sent me to confirm my visit:

Product: ATX  
Issue Summary: Telling me "we'll let you know" is really not an answer I can plan with. What is the ETA for restoring normal ATX functionality?  
Issue Resolution: Unfortunately, we do not have a specific timeline for when we expect service to be fully restored and we do apologize. For the latest updates, please check our corporate Facebook page and Twitter account.

Well that's just great!  I guess I will be relying on some of the really helpful members here because I'm not on Facebook or Twitter.   Please keep old timers like me posted. And Thanks!

[BrentCPA]

Presumably they opened up CCH Axcess for folks late yesterday (although some reports suggest it was then shut down again).  I am mainly concerned about the 990 deadline next Wednesday and this monster backlog of e-file ready returns I am sitting on . . .  as most of you know, the IRS requires us to transmit returns within three days of receiving the signed 8879 so I am officially out of compliance today.  To be frank, I will be surprised if they open e-filing up again before next Monday but I think if they do NOT have the EFC open by Wednesday 5/15 (and we all have to paper file extensions) they will lose so many customers that they would have been better off paying the ransom.  I for one was on the bubble about renewing after my software was incorrectly calculating Montana tax for most of March - after this I will likely be moving on.  Eventually, if you strip all the resources from a division, this kind of thing happens and although this season was rough for all tax preparation software providers I have not heard of anyone who had it worse than us ATX users. 

[tax123]

I have almost 30 business tax returns need to e-filed on next Wednesday, if the returns filed late because ATX issues, does it qualified reasonable cause for penalty abatement to IRS?

[ZoomnFinancial]

I thought it was me. Luckily I only have one extension that needs filing. I won't be pushing my other clients to get me stuff.  

[GLJEANNE]

This is driving me nuts.  I have one return that's awaiting the final ack, then a bunch of 990s either to send or file extensions.   Kicking myself for not putting in more hours last week! 

Plus, it's been in the news enough that clients are starting to ask about it, and what can we tell them?  CCH says no info was taken, but so far they haven't really given us straight answers, so I don't blame clients for being nervous.

All I can say is, THANK G-D this didn't happen during the season!!!

 

[Lee B]

51 minutes ago, tax123 said:

I have almost 30 business tax returns need to e-filed on next Wednesday, if the returns filed late because ATX issues, does it qualified reasonable cause for penalty abatement to IRS?

An interesting question, since you do have the option to paper file ?

[BrentCPA]

As of right now I am able to e-file again.  I cannot tell you for sure that my info is not being sent straight to Russia but at least SOMEONE is taking my e-files now.

[Danny Payne CPA]

[Update 9th May - 3:25pm]

Wolters Kluwer have started issuing customers with an update. As reported by Reddit user ManorTwpMan

My note: ATX seems to be next to last on the restore list. I did manage to actually get a support rep on the phone this AM. The systems are still down for the reps, too. Luckily, I have only one outstanding e-file, an Oklahoma one - and it's my own return, not due until October. But it was e-filed on Friday, 5/3, and as everyone knows, there is no way to check its status. I may call the Oklahoma Tax Commission to see if it's been accepted. I feel for those of you who have May 15 due dates. My next due date is June 15, so I'm in relatively good shape. Thinking this will be my last year with ANY CCH product, though.

The following is today's update from https://blog.tekkersit.com/wolters-kluwer-hit-by-mega-cortex-ransomware:

Dear Customer,

Thank you for your continued patience as we work to fully restore all of our applications and platforms. I am writing to update you on the progress we are making in this regard, as well as provide more context about how this situation originated and how we were able to effectively isolate and contain it before it could have any detrimental effect on customer data.

As previously shared, on May 6th when we started seeing technical anomalies in a number of our applications and platforms, we proactively isolated our systems out of an abundance of caution before any detrimental effects could occur. We have since been working with best-in-class anti-virus and security firms to develop and deploy newly released anti-virus solutions. This process assures a high degree of confidence in the security of our applications and platforms before bringing them back online.

It’s important to clarify that although there was malware on our network, we have seen no evidence that customer data and systems were compromised or that there was a breach of confidentiality of that data.

As you know, Wolters Kluwer delivers a suite of distinct applications in a variety of formats, each of which is designed to serve distinct segments of the tax and accounting ecosystem. We are in the process of scanning, testing, and restoring each service and application, and because they are distinct, they must be brought back online sequentially. We are restoring our applications and platforms in the following order:

 

• CCH® SureTax® (online)

• CCH Axcess™ (online)

• CCH® AnswerConnect (online)

• CCH® Intelliconnect® (online)

• CCH® Account Research Manager (online)

These following systems are still in process:

• Electronic Filing System (ELF for medium and large firm customers)

• CCH® Global fx

• ATX™ & TaxWise® electronic filing

• TaxWise® Online™

In short, the service interruptions you have experienced are primarily the result of our aggressive, precautionary efforts to ensure the safety of your data. This is why at this time we are confident that we see no indication of data loss or other effects, nor any potential risk to our customers’ data.

As we’ve noted before, we are working diligently around the clock to completely restore service and those efforts are continuing.

If you have any questions, we have established a dedicated customer support line regarding this incident at 800-930-1753 and a live chat capability at taxna.wolterskluwer.com. We appreciate your continued patience and will work to keep you updated as new information becomes available.

The Wolters Kluwer Team "

[Danny Payne CPA]

3 minutes ago, BrentCPA said:

As of right now I am able to e-file again.  I cannot tell you for sure that my info is not being sent straight to Russia but at least SOMEONE is taking my e-files now.

Good for you, Brent!

[Danny Payne CPA]

6 minutes ago, Danny Payne CPA said:

Good for you, Brent!

I just got acknowledgement of my one outstanding e-file from ATX, a good sign!

[GLJEANNE]

Oh hallelujah!  Though my ack still didn't come through, and not all transmitted files are able to go through, a few got a "not able to be transmitted due to an error" message.  Still, it's a start!

 

[tax123]

18 minutes ago, BrentCPA said:

As of right now I am able to e-file again.  I cannot tell you for sure that my info is not being sent straight to Russia but at least SOMEONE is taking my e-files now.

Thanks for reminding. I am able to e-file too. 

[BrentCPA]

Well, I got 23 of them transmitted but, alas, when I check for acks now I am back to the "unknown error" that I have been seeing since Monday morning.