Some CPAs and even their clients believe that because they are a CPA business and do not offer anything on the internet (or social media), they are not at risk of a data breach. However, with technology advancing rapidly, any business or CPA needs to be prepared for potential threats.
An email address can be used to log into a website. For example, if the website's password is stolen and the email address associated with the password is used for logging in to the website, the hacker can access the site and all the information stored.
When a cyber-attack is launched against a company, it's not just a matter of whether or not you can trace the source of the attack, but also whether or not your company will be able to withstand the potential damages of such an event. Unfortunately, a common mistake for businesses without an IT team is to assume that they are safe from cyber-attacks. And when cyber attacks do happen, the company may not have sufficient resources to recover from the damage done.
So, the hard answer is, I believe ALL CPA firms need cyber insurance.