IRS: Hackers Stole Some Taxpayers' Personal Info

In the latest major data breach of government information, thieves stole tax info from 100,000 people by hacking one of the Internal Revenue Service's database. It looks like some 200,000 attempts were made to get taxpayer personal info via the "Get Transcript" portal, which lets taxpayers access their past years' tax returns, and not through the main IRS site, according to the agency. The "Get Transcript" section of the site, which is now shut down, was hacked between January and mid-May.

So how did they do it? According to The New York Times, the hackers already had some taxpayers' information such as Social Security numbers, which they had gained access from elsewhere. By going through the "Get Transcript" system, the hackers used stolen information to get more information from past tax returns. Obviously, those tax returns contain a wealth (no pun intended) of specific detailed information about taxpayers. The hackers were able to successfully move through several steps of authentication on the IRS site using the stolen data, to get even more personal information contained in the previously-filed tax returns.

In perhaps the most unsettling detail of this situation, the IRS doesn't think this was the work of work of amateurs, but rather a sophisticated group of criminals, IRS Commissioner John Koskinen told the Times.

These actually are organized crime syndicates that not only we but everybody in the financial industry are dealing with.

Koskinen told The Washington Post the IRS doesn't believe the latest incident is related to the problems Turbo Tax had earlier this year, which prompted a temporary shutdown of its e-filing system in February. Turbo Tax's parent company Intuit noticed suspicious e-filing activity, which eventually prompting investigations by the FBI and other regulatory agencies.

The Times points out that what happened to the IRS website appears to be the result of a kind of snowball effect, likely helped by other high-profile data breaches. One of the biggest breaches of last year happened at Home Depot, which fell victim to malware used by sophisticated hackers to get sensitive customer information at self-checkout registers at stores in the U.S. and Canada.

The criminals involved in the Get Transcript data theft already had taxpayers' information that had been compromised elsewhere. According to the Times, the IRS paid $5.8 billion in false tax refunds in 2013 alone. For this breach, the agency said it will send notification letters to taxpayers whose accounts were affected.

Images: Getty Images (1)