Another government agency, another hack
In early 2014, the Internal Revenue Service launched a new feature on its website referred to as ‘Get Transcript.’ This feature allowed taxpayers to view and download their transcript, or a document that lists most line items on a tax return and includes accompanying forms and schedules.
In May of last year, the IRS announced its Get Transcript feature had been hacked by criminals using taxpayer information that was obtained by different means. At this time, the IRS had determined that a little over 114,000 taxpayers’ returns were accessed and the Get Transcript feature was taken offline. By August, the IRS revised the original number to 334,000 breached or targeted tax returns.
As of last Friday, however, the IRS added another 390,000 taxpayers to the list, upping the number of accounts effected to over 700,000. Not included in this number are 500,000 accounts the hackers targeted but were unable to obtain.
Information contained in the transcripts includes names, social security numbers, birth dates, addresses, and other information that could be used for identity fraud purposes as well as falsifying a return to obtain another person’s tax refund.
— IRS (@IRSnews) February 28, 2016
In a statement released last week, investigators noted the possibility that not all of the cases necessarily involved hackers. “It is possible that some of those identified may be family members, tax return preparers, or financial institutions using a single email address to attempts to access more than one account. However, in an abundance of caution, IRS will notify all taxpayers impacted,” the statement said.
Earlier this month, chairman of the House Committee on Oversight and Government Operations Rep. Jason Chaffetz expressed disapproval with the state of electronic information security at the IRS. In a February 11 hearing Chaffetz criticized the agency’s vulnerability. “This level of incompetence is intolerable for an agency where millions of people file their most personal information.” He went on to say that the IRS “doesn’t have its house in order at any level.”
The fact that investigators have not determined which accounts were breached by malevolent actors and which were breached by innocent parties is troubling to say the least. IRS Commissioner John Koskien, who Chaffetz has demanded resign, said the agency intends to mail notifications to the taxpayers whose accounts appeared to be compromised. They will also receive one year of free identity theft protection from Equifax.