If hackers have it their way, you may not be getting that tax refund from the IRS. Online thieves were recently able to get their hands on taxpayer identification numbers before the Internal Revenue Service detected the attack and shut it down, the agency revealed Tuesday.
The "Electronic Filing PINs," meant to ensure information is safe, would enable hackers to file fraudulent tax returns. As the number of tax returns being filed online has continued to rise -- it's expected to be 80 percent of the 150 million returns filed this season -- so too has the number of attempts by hackers to file fake returns and steal people's refunds.
The attack revealed Tuesday involved specialized software that used more than 450,000 stolen Social Security numbers to try to generate e-filing PINs. Attempts involving about 100,000 of those SSNs were successful, the IRS said in a statement. The SSNs were "stolen elsewhere outside the IRS," the agency said, adding that "no personal taxpayer data was compromised or disclosed" by its systems. The agency said it will notify people affected by the attack and will mark their accounts to guard against identity theft.
It's not surprising that hackers find tax returns tempting. After all, the documents have your income, birth date, home address, family details and SSN written right on them. Such information can be used not just to steal your tax dollars, but also to break into other systems, like your bank, credit card or social-networking accounts. Is one of your security questions your mother's maiden name? Hacks could glean that name from your family's tax returns.
Despite storing a massive trove of data on American citizens, the federal government has struggled to protect it from hackers. That includes the IRS, which hackers attacked last year to steal tax records of perhaps 300,000 people. The agency has even struggled with fraudsters in its ranks; on Monday it successfully prosecuted an employee for identity theft and conspiracy to commit bank fraud.
All of this is part of why President Barack Obama proposed, on Tuesday, to spend $19 billion on more-secure technology for the government. If approved, the funds would help in efforts like recruiting cybersecurity experts, reducing reliance on unsafe items like SSNs, and overhauling the government's computers.
"The caliber of the enemy we're facing is incredibly sophisticated and global," IRS Commissioner John Koskinen told the Senate Finance Committee at a hearing Wednesday, in response to a question about the most recent hack. The attackers come from professional crime rings operating throughout the world that target governments and financial institutions to steal data and money.
Many times these attacks involve stolen SSNs, which are usually amassed in other hacks and sold on the black market. Last year, online attackers used personal data like these numbers to guess security questions on taxpayer accounts, sometimes breaching the accounts and stealing old tax returns. With all this stolen personal information in the hands of hackers, Koskinen said, the government needs help. So, the IRS is sharing details on the hackers with the private sector. "We can't solve it by ourselves," he said.
