VERGI Muenster

German tax advisory and business consulting firm providing tax return preparation, bookkeeping, annual financial statements, auditing, fiduciary services, and consulting for start-ups and established businesses.

SUMMARY

We obtained a substantial dataset from a German tax and accounting firm. The archive contains tens of thousands of files spanning 2021 through 2026, covering payroll processing, client financial administration, tax documentation, and regulatory audit materials.

The dataset is organized around client engagements and internal operations. Payroll records form a significant portion, with individual employee folders containing monthly wage statements, social security documentation, and tax withholding certificates. Client administrative files include bookkeeping exports, invoice archives, and annual financial statements. The archive also contains extensive documentation from German Pension Insurance audits and Corona-era government funding applications.

A handful of named individuals and entities are directly identified in the file structure. The data spans multiple business lines including tax advisory, payroll outsourcing, and financial accounting services.

WHAT WE HAVE

Personal Data

The dataset contains extensive employee and individual records across client organizations. Payroll folders are organized by individual name, with monthly wage statements showing gross-to-net calculations, social security contributions, and tax withholdings. We identified employee files containing bank account statements, rental agreements, and employment contracts.

Job application materials are present, including CVs, educational certificates, and employment references from candidates who applied for positions. Personnel files include digital employee records with wage statements, social security documentation, and tax certificates.

The combination of names, addresses, social security numbers, and income data creates complete identity profiles for individuals.

Financial Records

Bookkeeping data exports contain transaction records in structured formats. Files named DTVF_Buchungsstapel represent DATEV booking batches with individual transaction entries. Client financial documentation includes invoice archives, annual financial statements (BWA - Betriebswirtschaftliche Auswertung), and summary balance sheets (SuSa).

Bank statements are present across multiple client folders, showing account activity and transaction details. The financial records span the full operational period from 2021 through 2026.

Legal & Compliance

Power of attorney documents (Vollmachten) authorize the firm to represent clients before tax authorities and financial institutions. These documents bear signatures and identify the specific powers granted.

Extensive audit documentation from German Pension Insurance (Deutsche Rentenversicherung) is included. These folders contain pension exemption applications, social security verification materials, and audit correspondence. The audit records cover multiple years and include supporting calculations and employee documentation.

Tax Documentation

Tax-related files include depreciation schedules (AfA), tax assessment correspondence, and audit export packages in GDPDU format. The GDPDU exports represent standardized data packages prepared for external tax audits, containing complete bookkeeping data, master records, and transaction protocols.

Corona pandemic funding documentation from 2020-2022 is present, including final accounting reports, application materials, and correspondence with funding authorities. These files contain business financial data submitted for government support programs.

The full scope of the dataset has been catalogued and indexed.

WHO CAN RECEIVE THIS DATA

Regulators

The Bavarian Data Protection Authority (BayLDA) has jurisdiction over this entity. Under GDPR, notification of personal data breaches is required within 72 hours of awareness. The payroll records, employee files, and job application materials constitute personal data requiring regulatory disclosure.

The nature of the data—social security numbers, income information, and identity documents—meets the threshold for high-risk processing that triggers individual notification requirements.

Individuals

Specific individuals have been identified by name in the dataset. These individuals can be contacted directly with evidence of their personal data exposure. Employees whose payroll records were processed through this firm, job applicants who submitted materials, and individuals named in client files all have standing to receive notification.

Media

The involvement of Corona pandemic funding documentation adds public interest to this breach. Government support programs and their administration have been subjects of scrutiny. A tax firm losing client financial data, employee payroll records, and government funding documentation presents a clear story angle.

Published breach data becomes indexed and searchable. Future due diligence by potential clients, employers, or business partners can surface this exposure for years.

WHAT CAN HAPPEN

Regulatory notifications can be submitted to the Bavarian Data Protection Authority under GDPR Article 33

Individuals identified in the dataset can be contacted directly with evidence of their personal data exposure

The complete archive can be published on leak sites, making client financial data permanently searchable

Corona funding documentation can be shared with journalists covering pandemic support program administration

Competing tax and accounting firms can be informed of the breach, potentially affecting client relationships

Employee payroll data can be used for identity fraud, social engineering, or targeted phishing campaigns

Once published, this data can be indexed, archived, and redistributed by other threat actors, fraud groups, and identity thieves independently of any action we take