More than 2 million user records from TaxAct allegedly acquired; 450k already leaked (1)

**Executive summary:** An anonymous source provided DataBreaches samples and alleges TaxAct had its user-account backend exposed via unauthenticated APIs, allowing full read access to account records; a 450,000-record dump with emails, phone numbers, usernames and account flags was posted to Russian-language forums. DataBreaches attempted vendor contact with limited response; if verified, the exposure of PII creates significant phishing, spam, and doxxing risk and requires rapid investigation and customer notification.