It was initially reported that the hack against the Internal Revenue Service resulted in tax return data on more than 100,000 taxpayers being stolen.
Advertisement
The IRS said a deeper look at the breach indicated that hackers may have gained access to an additional 220,000 taxpayer files.
Part of that process will be a round of letters to the newly identified taxpayers whose data was or might have been accessed through the Get Transcript portal.
The IRS is now sending letters to those taxpayers to warn them about potential identity theft, offer free credit protection and give them an extra PIN to protect future tax filings.
It’s not entirely clear whether the Russian hackers breached the IRS servers, or simply managed to use a mixture of social engineering along with user details such as stolen social security numbers to access the system.
So if you never had a “Get Transcript” account with the IRS, you have nothing to worry about regarding this breach. But a thorough review of activity on the IRS site throughout the 2015 tax-filing season revealed that the intrusion affected almost three times that many accounts, the agency said Monday.
Simon Crosby, co-founder and chief technical officer at security firm Bromium, added that the IRS hack was the “last big piece in the puzzle” for nation state actors seeking to construct a detailed map of US society. Those attackers were much more successful at answering security questions than previously known, the government agency announced Monday, underscoring the dangers of using simple security to protect valuable data.
Armed with that critical personal information, the IRS believes the thieves meant to get even more sensitive information that could help them reap profits from fraudulent refund claims.
It’s where taxpayers can get tax returns from previous years, and other filings.
The IRS didn’t clarify how far back its latest review went but according to a Wall Street Journal article Monday the agency looked at data from as early as November 2014, roughly four months before the IRS’ initial investigation, from February 2014 to May 2014.
Advertisement
In June the Treasury inspector general told Congress the IRS failed to implement security upgrades to its computer systems.
