Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Government Privacy United States News Your Rights Online

IRS: Personal Info of 100,000 Taxpayers Accessed Illegally 85

Posted by Soulskill from the disincentive-to-pay-your-taxes dept.
An anonymous reader writes: The Associated Press reports that an online service provided by the IRS was used to gather the personal information of more than 100,000 taxpayers. Criminals were able to scrape the "Get Transcript" system to acquire tax return information. They already had a significant amount of information about these taxpayers, though — the system required a security check that included knowledge of a person's social security number, date of birth, and filing status. The system has been shut down while the IRS investigates and implements better security, and they're notifying the taxpayers whose information was accessed.
This discussion has been archived. No new comments can be posted.

IRS: Personal Info of 100,000 Taxpayers Accessed Illegally More

IRS: Personal Info of 100,000 Taxpayers Accessed Illegally

Comments Filter:

  • DoB, SSN & Filing Status?? (Score:5, Insightful)

    by CrimsonAvenger ( 580665 ) on Tuesday May 26, 2015 @04:06PM (#49777647)

    That's all the ID the IRS requires to use their "secure" site???

    Jaysus, you can get most of that (SSN & DoB) by looking at someone's Driver License in most States.

    And guessing Married Filing Jointly will work more often than not, I expect....

    • Re: (Score:1)

      by Anonymous Coward

      They require more than that. They tie into a credit agency.

    • Re: (Score:2)

      by suutar ( 1860506 )

      and if not MFJ, there's only 3 other possibilities. So they're really counting on the SSN/DOB to remain secret... except for every credit application ever.

    • you can get most of that (SSN & DoB) by looking at someone's Driver License in most States

      Are there still states that want to use SSN as driver's license id number? I lived in a state that did that (VA) years ago but you could refuse and have them generate a DL number. The employees at the DMV hated that request and tried to bully you out of it, but would eventually relent. I thought I heard they started generating DL numbers for everyone though, so what's with your assertion?

    • Re:DoB, SSN & Filing Status?? (Score:5, Interesting)

      by pehrs ( 690959 ) on Tuesday May 26, 2015 @05:07PM (#49778049)

      Say after me ten times: Identity is not Authentication, nor Authorization. Identity is not Authentication, nor Authorization. Identity is not...

      Now, got that? You are making the same sad mistake that the IRS did. You are confusing Identity with Authentication.

      SSN & DoB are perfectly fine identifiers for a person. Not quite unique, but they will work for the purpose.

      The problem is that there is no authentication, nor any authorization infrastructure for them to use as far as I know. There are in other countries (see for example https://www.bankid.com/en/ [bankid.com]). I have understood that there are ideological reasons not to roll out a decent Authentication/Authorization infrastructure in the US, but the lack of such an infrastructure will cost US business (and private person) more and more dearly as important information moves to the internet.

    • Re:DoB, SSN & Filing Status?? (Score:5, Insightful)

      by Charliemopps ( 1157495 ) on Tuesday May 26, 2015 @05:19PM (#49778107)

      That's all the ID the IRS requires to use their "secure" site???

      Jaysus, you can get most of that (SSN & DoB) by looking at someone's Driver License in most States.

      And guessing Married Filing Jointly will work more often than not, I expect....

      I know, it's hilarious. These agencies/companies get hacked due to their own willful negligence... then scream "Hackers did it!" like hackers have magic hacking wands that turn servers inside out. It seems that the only piece of info that would have been remotely hard to get was filing status... which the "hackers" just guessed at. It looks like they were 50% successful, and I bet if compared with the victims filing status, they likely had a 50% chance of filing jointly or something. What a joke. This is completely and entirely the IRS's fault.

      Make a new law, if you get hacked, you have to pay the person whos data you lost $100,000. Problem solved. You can then decide if spending time on securing the data is worth it, or if you just want to not store it. It IS possible to prevent this sort of thing. These agencies and companies just don't think it's profitable to do so when the penalty for losing a persons info is nothing more than a press release.

      • Better yet, those same agencies are 100% supportive of fining private enterprise for the same thing... But they believe they are simply innocent victims of outside attacks and shouldn't be held responsible.

        • Better yet, those same agencies are 100% supportive of fining private enterprise for the same thing... But they believe they are simply innocent victims of outside attacks and shouldn't be held responsible.

          But this wasn't even an "attack" they used the form as it was intended to be used and just guessed at the inputs. That's like putting a combination lock on your safe that only has 1 digit, setting it to "1" then, after your customers Jewelry is stolen claiming there's nothing to can do to stop a determined Global criminal organizations that employ master safe crackers.

      • Make a new law, if you get hacked, you have to pay the person whos data you lost $100,000.

        Yeah, that will work really well with the government. Hey, we got hacked 100 times last year. In totally unrelated news, income taxes are going up and we just hired 1,000 new IRS employees because, obviously, those people need more help.

    • well and does it let you try a second time with single if the other doesn't work?

    • Re:DoB, SSN & Filing Status?? (Score:4, Informative)

      by NicBenjamin ( 2124018 ) on Tuesday May 26, 2015 @10:06PM (#49779711)

      There's more to it then that.

      There's a section asking questions taken partly from the IRS database, and partly from your credit report. The questions are hard enough that when I did taxes at H and R Block it was not unusual for people to fail the test. In particular the form was very finicky about your address, and god help you getting on the site if you'd misspelled your street name on your tax return. But if I had been a determined hacker with one of those PII databases I probably could have turned a good half of them into transcripts, and used the transcripts to file tax returns. You get a couple tries a day, after all.

      BTW, it's currently illegal to use an SSN as a Driver's License number. Has been since 2004 [ssa.gov]:
      [Public Law 108-458] "Prohibits Federal, State, and local governments from displaying SSNs, or any derivative thereof, on drivers' licenses, motor vehicle registrations, or other identification documents issued by State departments of motor vehicles."

  • This took a lot longer to happen than I thought it should've.

  • Contradictory information (Score:2, Insightful)

    by Anonymous Coward

    In order to access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address.

    In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles.

    Email doesn't go through a "security screen". Do they mean "questionable IP addresses" rather than "email domains"?

    • I believe they meant:
      After the page where you fill in security questions, they ask for the email and send you the report and the addresses the reports were sent to were suspicious.

  • Those affected should be able to sue, there needs to be accountability.

    • Those affected should be able to sue, there needs to be accountability.

      While I agree 100%, we're talking about the US government here. Nobody will be fired. Nothing will change.

    • I agree, have they caught any of the scum hackers yet?

  • Mad Lib (Score:5, Insightful)

    by Voyager529 ( 1363959 ) <voyager529 AT yahoo DOT com> on Tuesday May 26, 2015 @04:17PM (#49777701)

    [NEWS_OUTLET] reports that an online service provided by [ORGANIZATION_WITH_PERSONAL_DATA] was used to gather the personal information of [CUSTOMERS_OR_USERS]. Criminals were able to scrape [INSECURE_SYSTEM] to acquire [SUPPOSEDLY_SECURED_INFORMATION]. The system has been shut down while [OVERPAID_AND_INCOMPETENT_ANALYSTS] investigate and [PROMISE], and they're notifying [CUSTOMERS_OR_USERS] whose information was accessed.

    At this point, you can turn this story into a Mad Lib, and fill in the blanks with basically any set of nouns, and it'll mostly be true.

  • Very Serious (Score:3, Insightful)

    by Anonymous Coward on Tuesday May 26, 2015 @04:18PM (#49777721)

    This is actual even more serious than it sounds since the IRS basically gave the criminal a mean of mass validating their existing data. They have in effect proven valid SSN/Birthday pairs now ready to be used and abused.

    • Re: (Score:2)

      by mark-t ( 151149 )
      One would think that if one were liable to want to use such info for criminal purposes, that one would tend to be reasonably expeditious about it, since the more time elapses while you are trying to use that information, the greater the chance that you will be discovered. The reality is, however, that there's a whole heaping mountain of red tape that even someone who has genuinely lost their wallet will have to go through just to prove their identity in today's society, and if you lose your wallet within a
      • I'm not so sure. Someone's identity isn't going anywhere soon. Once you have the info, it seems like the sensible thing to do would be to sit on it for awhile. This way you distance yourself from the breach. Assuming the breach is known and made public, the affected individuals will be on guard, checking for suspicious activity. But for how long? Maybe in a year or so, take out a bunch of credit cards and convert to cash as quick as possible. Bam, done! The info is just as valuable (minus a small percent),

        • I've done some research on the topic, being a victim of identity theft myself. From what I understand, the person who steals the identity rarely uses the stolen identity. Instead, they sell it to someone else who then uses it. This way, the real thief gets some quick cash with less risk of getting caught - especially if it's an inside job. (e.g. Someone in HR at your company downloads your company's employee records to a USB drive and decides to make a little money on the side.) Meanwhile, the people u

  • Yeah (Score:5, Interesting)

    by Anonymous Coward on Tuesday May 26, 2015 @04:20PM (#49777737)

    The existence of this system was reported previously on slashdot, and people were recommending that you sign up before a criminal signs up in your name. That way you can protect the account with your own strong password.

    Which is exactly what I did. And I am now quite happy I did. And I don't mind a bit that they shut it down anyway.

    • Re:Yeah (Score:5, Interesting)

      by ChromaticDragon ( 1034458 ) on Tuesday May 26, 2015 @09:01PM (#49779403)

      So did I.

      But then I stopped and thought a bit about the concept of Testing for Success vs. Testing for Failure. The former is weak testing... lazy testing. It WORKS. That's nice... But does it fail as it should? Have you tested when and how it fails? Do you know the limits?

      So... I decided to act as an identify thief. As previously reported then and now, getting the credentials to sign up are easy. OK. But I had already signed up. So that'd protect me, right?

      NOT AT ALL.

      It was trivially easy to sign up again. Oh sure, an email gets sent to the first email address set up. But this leads to one of two situations. First, the proper user doesn't check his email for a while. Then whatever the thief is going to do they can do. Second, the proper users finds out immediately and gets on and takes it back over. All good? Comically, no. Believe it or not (and I was really stunned at this part) the webapp doesn't force logout the identity thief when the proper user reregisters.

      I was a tad sickened at this point.

      As far as I could tell, this was utterly and completely insecure. The only way for an "average joe" to protect themself here was to sign up and then freeze credit completely at all the credit bureaus. Supposedly (haven't finished this part yet) once you do that, the 20-question stuff will IMMEDIATELY fail and anything like this IRS.GOV site that depends on it will also fail.

      Oh... but it was rather interesting to see what the IRS had stored on me... and what they didn't have. It was somewhat perplexing.

  • They probably acessed the transcript to obtain this number. The AGI would not be in other identity leaks like SSN, DOB and address.

  • Last Straw (Score:5, Funny)

    by frovingslosh ( 582462 ) on Tuesday May 26, 2015 @04:35PM (#49777839)
    That does it. I'm going to quit giving them my business.

  • Freeze your credit. Problem solved. (Score:1)

    by Anonymous Coward

    Unless you're in the market for something you cannot pay for in cash or with the current line of credit, your credit must be frozen. This solution costs about $30 ($10 per freeze x 3 agencies) and that is a small price to pay for a reduced risk of a stolen identity. This is due to the fact that in many cases your financial history is used to verify your identity and a credit freeze makes the financial history unavailable. For example, if you try to register for an IRS account while having a credit freeze, t

    • That's what we did when my identity was stolen. My name, address, SSN, and DOB were used to open a card in my name. I was lucky and the credit card company sent it to me (due to the thieves paying for rush delivery) instead of processing the address change and sending it to the thieves. It's a pain when I want to use my credit (refinance mortgage, buy a car, etc), but most days I don't need to touch my credit and don't want anyone else touching it either.

      Of course, the credit agencies don't like when you

    • While this will solve most of the problems it still shouldn't be something that needs to be done, or at least something that shouldn't cost money to have done.

  • I'm in the process of dealing with something like that now: someone filed a tax return for me before I got around to it. As a result, I had to file on paper, including an "identity theft affidavit" and a copy of some id, but they still sent back a letter requiring me to verify my identity. The online system rejected me (probably because it was asking for information on the fraudulent return), requiring me to call in. After wading through a 5 minute phone tree to get to a human, the system says "sorry, we

    • If you owed money you'd have to send it in anyway. Identity theft is not gonna get you out of the failure to pay penalty.

      Keep in mind all this would go away if we were just willing to wait for our tax refunds. He beats you to the IRS? Who cares -- by May they will have the correct income documents so they'll know which one of you is you and which is the fraudster. But since we have to have our money NOW we deal with fraud.

      OTOH, since we basically run our Welfare State through the tax system (ObamaCare is te

      • Re: (Score:2)

        by vanyel ( 28049 )

        No, for the same reason you couldn't get away with not paying, you can't get away with ignoring the refund - the right tax return has to be filed. They could already tell if they cared to look, as my tax return is not simple and it's highly unlikely that the fraudulent one looks anything like the real one. The best case that would come out of ignoring it is an audit, and no one wants that.

    • This is exactly what happened to me, due to the Anthem breach.
      Here's a hint: call the IRS at exactly 0800 ET, when the lines open. I waited on hold for about 2 minutes, and it took approximately 45 minutes to complete the process.
      NOTE: Check your junk mail carefully. I detected the fraud because a 'Green Dot' prepaid debit card arrived in the mail. The fraudster had purchased a generic card retail with $10 loaded on it, as the IRS, in their infinite wisdom, accepts these accounts for refund payments.
      I

      • Re: (Score:2)

        by vanyel ( 28049 )

        Gave up on trying to call into the IRS and went down to the a nearby (well, 40 miles) office yesterday early afternoon. It wasn't actually crowded surprisingly, but the guy that handles real things (as opposed to taking checks and other minor receptionist duties) wasn't there, so I had to come back today. Got there bright and early and got it taken care of with a "they say up to 180 days for your refund". The receptionist had said "he can push it through" but apparently not really. Oh well, hopefully it won

  • It's not just the IRS (Score:4, Insightful)

    by Sir_Eptishous ( 873977 ) on Tuesday May 26, 2015 @05:40PM (#49778253)
    Yea, /. had a story about the IRS and SS sites a while back.
    Make sure your log in and create an account for the Social Security Administration too.

    It really is getting ridiculous how frequent this shit is happening now.
    It's almost to the point where people don't even pay attention:
    "Oh wow, another big financial institution got hacked... Another fifty million Americans data is in the hands of criminals... What can we do about it?"

    The average American is at their wits fucking end trying to keep up with all their accounts, passwords, blah diddy fucking blah shit they have to keep track of. For most of us this isn't an issue, but you can guarantee that for the vast majority of Americans, they are flying blind when it comes to all various requirements for being secure online. Oh, and lest I forget(how could I?) all of these security problems we encounter daily are always for convenience of the user(Trust Us!). Convenient apps/plugins/sites/tools to make your life easier:
    "Isn't your life easier with our no security, pro-hacker enabled widget? Why, within a matter of moments of using our widget your personal data, financial data and medical data will be in the hands of our trusty hacker/malware infested servers in DerkaDerkaStan, where our trusty staff of well trained consultants will bleed you dry before you can click the X in the upper right hand corner. Why, to deny such a widget would be an affront to America, to the very meaning of Freedom and Capitalism!"

    To be less hyperbolic, think of what it takes to have even a modicum of security online. We've got to have hardened browsers(NoScript, AdBlock, etc), we have to have different id/pw combinations for all important sites(that one really messes with people...), we have to have an account with a credit monitoring/credit agency(Equifax, etc) to monitor our financial accounts, we have to have up to date settings, firmware on our DSL/Cable modems, we have to have our OS security settings correct, AV/AntiMalware, etc, etc, etc

    Have fun with all that, average American(it's bad enough for "advanced" users).

    • Re: (Score:2)

      by sudon't ( 580652 )

      A password manager solves most of these problems. You don't have to be an "advanced user" to use one, but since Microsoft hasn't seen fit to include one with their OS, few people have them. Mac OS has come with a password manager since 1999, but that's a much smaller user base. I can't understand why they haven't made it part of iOS.

  • Yet, no one get's fired. No one is held accountable. The organization continues to operate as a political operative.

  • simplify the tax code, institute a flat tax, abolish the bloated corrupt bureaucracy that is the IRS

    although I for one welcome our kinder gentler overlords at the IRS that I'm sure will come out of this obvious example of incompetence /duck and run

  • Everyone sue the IRS! That'll teach them! Oh wait, you can't. Tough luck, buddy. Just keep trusting your government though-- because you really have no choice.
  • I used this system to get a reprint of last year's form, lost to a hard drive crash (yes, I know, backups). How can anyone distinguish legitimate from illegitimate access?

Slashdot Top Deals

"In my opinion, Richard Stallman wouldn't recognise terrorism if it came up and bit him on his Internet." -- Ross M. Greenberg

Close