Taxpayer Information Stolen From IRS Website
| published May 27, 2015 |
By Keith H. Roberts Thursday Review contributor
The U.S. Internal Revenue Service says that more than 110,000 American taxpayers may have had their personal data stolen by high tech, professional hackers armed with a lot of knowledge about both computer code and the IRS database.
Hackers used a portal called “Get Transcript” to steal personal information. The “Get Transcript” online application—designed to be a user-friendly tool for people to file their taxes or to apply for college loans or refinance their homes—allows taxpayers to gain access to their own past tax records and returns dating back several years. Criminals with a particularly keen understanding of the IRS’s computer systems rewrote the code to trick the program into allowing the hackers to bypass a security and identification portal. Once inside, the hackers could easily view and copy full names, addresses, social security numbers, birth dates, and other key information.
Investigators say the hackers may use the stolen data for identity theft purposes, or—more likely—to file phony tax returns using alternate addresses, an increasingly popular form of fraud already known to have cost U.S. taxpayers more than $3.5 billion for the 2012 tax year, and more than $5.8 billion in 2013. IRS officials say that lack of funding and lack of up-to-date security tools could result in a doubling of that dollar figure over the next two years.
The data breach could have been much worse. The IRS says that the only reason the hackers stopped with 110,000 was that several computer technicians noticed an unusual surge in the number of U.S. taxpayers seeking access to past data through “Get Transcript.” The brief, sudden spike in activity was dramatic enough that techs began examining what was happening, and were able to alter the code to lock out the hackers.
IRS officials say that at no time were the main IRS computers or the taxpayer information those computers harbor ever at risk, but only the records accessible using the “Get Transcript” service. The data breach only affected a tiny percentage of all U.S. taxpayers.
Still, several members of Congress want answers to how hackers could so easily gain access to the portal. Wisconsin Representative Paul Ryan, chairman of the powerful Ways & Means Committee—which oversees tax law and tax collection legislation—says that the IRS needs to remain vigilant regarding personal information.
“It’s deeply concerning,” Ryan said, “that taxpayer information has been compromised. Protecting the taxpayer is supposed to be the IRS’s top priority.”
Security analysts worry that the breach of the portal for past tax records and filings could signal that hackers are willing to raise the stakes in the increasingly complex battles over personal information and theft. The IRS says it suspects, but cannot prove, that the recent data breach was the result of organized criminals abroad. Typically, phony tax returns are filed very early in the tax season, often using a direct deposit system, or by requesting that refunds be sent to a prepaid debit card account or to bank accounts in other countries.
The IRS has frequently said that, although it seeks to protect the personal data of taxpayers, it is woefully underfunded to police every aspect of every potential form of data breach or criminal hack.
Related Thursday Review articles:
Russians May Have Been Behind White House Cyber-Attack; Thursday Review; April 8, 2015.
China May be Behind Anthem Cyber Attack; Thursday Review; February 6, 2015.