More than 100,000 taxpayers had their tax records exposed to identity thieves and criminals as a result of an IRS security breach.
The US Internal Revenue Service announced that thieves had illegally accessed more than 100,000 tax records and had made unsuccessful attempts at accessing another 100,000 taxpayer accounts.
The culprit of the breach is weak security authentication using the IRS's Get Transcript application tool online. The tool was taken down late last week, and the IRS website says that users who need to obtain transcripts or records can do so by mail using form 4506.
The breach
Unauthorized access occurred between February and March this year. In order to gain access to records, identity thieves must already have access to victims' personal information, including Social Security numbers, date of births and other identifying information.
IRS Commissioner John Koshiken maintained that the Get Transcript tool was legitimately accessed by 23 million users this year, but the agency identified more than 200,000 attempts that could be fraudulent.
Impact
When identity thieves gain access to tax transcripts illegally, they can file fraudulent tax refunds. The agency believes that only a small proportion of tax refunds filed are fraudulent. Koshiken says that no more than 15,000 tax refunds filed may be bogus, resulting in a loss of $50 million.
However, if criminals have tax transcripts, identity thieves can wreak greater financial havoc by using the obtained personal information for other financial crimes.
The agency is sending out letters to the more than 200,000 taxpayers that may be affected, offering free credit monitoring service for added protection. If you don't reserve a letter from the IRS, you don't need to be concerned.
This is not a hack
The agency's computers and servers were not compromised or hacked in any way, Koshiken insists, stating that the attacks were carried by sophisticated criminals. The agency was alerted when its system noticed an unusual amount of activity related to the Get Transcript application. Initially, it believed that this was a result of a denial-of-service, or DoS, attack.
A recent research estimates that security breaches can cost the economy as much as $2.1 trillion (around £1.35 trillion, or AU$2.6 trillion) by 2019.
- Read our list of the top ten data breaches in the last 12 months
