We’re Only One Month Into The Tax Filing Season, And The IRS Has Already Been Attacked


Criminals attacked the IRS’s digital systems in an attempt to steal data that could be used to collect fraudulent refunds, the agency announced this week.

The incident was the latest in a string of identity-theft-related breaches that have been announced by tax officials and tax software companies so far this year. The news also comes shortly after the IRS temporarily stopped processing tax returns last week, an issue it says was unrelated to the online attack.

Using stolen personal information obtained elsewhere, the criminals used an automated bot to try to obtain electronic filing PINs from the IRS’s website last month, the agency said in a statement. Taxpayers can sometimes use the PINs to help verify their identities when they file returns online.

The thieves attempted to collect PINs for more than 464,000 stolen Social Security numbers but were only successful with 101,000 of them. The agency said it would let the affected taxpayers know by mail that criminals used their personal information to attempt to access the IRS’s systems. It said no other taxpayer information was compromised.

The breach was the most recent hiccup that taxpayers have encountered less than one month into the tax filing season. Last week, the IRS dealt with a roughly day-long outage that forced it to stop processing tax returns and blocked taxpayers from accessing the “Where’s my refund?” tool online. The agency said the outage, caused by a hardware failure, should not significantly delay tax refunds.

At least two tax software providers have also alerted taxpayers of attacks where criminals took over online accounts and gained access to sensitive tax data. The most recent incident came from TaxSlayer, which notified 8,800 people that their accounts may have been accessed by thieves using stolen usernames and passwords. Another tax software provider, TaxAct, reported a similar attack in January where criminals used stolen usernames and passwords to access information from 450 tax accounts, though the company detected suspicious activity on roughly 9,000 accounts.

Tax officials said before the start of the filing season that they would be on guard against tax-related identity theft, which proved to be a growing issue last year. The IRS dealt with a separate attack on its “Get Transcript” feature in 2015, where criminals attempted to steal tax return information from as many as 610,000 taxpayers.

The number of identity theft complaints filed with the Federal Trade Commission surged by nearly 50 percent in 2015 from the year before, primarily because of tax fraud, the agency said. This year, the IRS, state tax agencies and tax software companies said that they would share information about suspicious filings and online attacks to crack down on fraud.

(c) 2016, The Washington Post · Jonnelle Marte