I'd agree with the advice on getting the lawyer, but also, would add that the Fed C and the State C should be the same, or with easily explained state differences, so giving them both should not be an issue, but giving client data makes zero sense to me, so I'd only give them access to what my lawyer told me to give them. And I'd want the notification to come from the taxing authority, not the CPA that says that they hired.