It has a familiar refrain: A computer breach with the federal government is bigger than first thought.
That is exactly what is happening in the hack of the Internal Revenue Service (IRS) where thieves stole tax information from thousands of taxpayers.
An additional 220,000 potential victims had information stolen from an IRS website as part of a sophisticated scheme to use stolen identities to claim fraudulent tax refunds, the IRS said Monday. The update more than doubles the potential victims, to 334,000.
The breach also started earlier than investigators initially thought. The tax agency first disclosed the breach in May.
The thieves accessed a system called “Get Transcript,” where taxpayers can get tax returns and other filings from previous years. To access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address, the IRS said.
The personal information appeared stolen from other sources. The IRS believes the thieves were accessing the IRS website to get even more information about the taxpayers, which could help them claim fraudulent tax refunds in the future.
“As it did in May, the IRS is moving aggressively to protect taxpayers whose account information may have been accessed,” the IRS said in a statement. “The IRS will begin mailing letters in the next few days to about 220,000 taxpayers where there were instances of possible or potential access to ‘Get Transcript’ taxpayer account information.”
“This attack highlights the fact that Big Data isn’t just something utilized by legitimate businesses, but also cyber criminals and fraudsters,” said Ken Westin, senior security analyst for Tripwire. “The data used to perpetrate this attack was originally harvested from multiple sources, including open source data and data from other breaches. In this case, the criminals were able to quickly correlate disparate data sets to create complete profiles; once this was completed, they then automated the IRS ‘Get Transcript; form submission to extract additional information that can then be used to file fraudulent tax returns.”
In all, the thieves used personal information from about 610,000 taxpayers in an effort to access old tax returns. They were successful in getting information from about 334,000 taxpayers.
The IRS isn’t the first agency — public or private — to initially underestimate the magnitude of a data breach. The Office of Personnel Management announced earlier this year hackers had stolen sensitive information on 4.2 million people. The number of affected people has since grown to more than 21 million.
The IRS said it is notifying all potential victims and offering free credit monitoring services. The IRS is also offering to enroll potential victims in a program that assigns them special ID numbers that they must use to file their tax returns.
The IRS said Monday thieves started targeting the website in November. Originally, investigators thought it started in February. The website shut down in May.
On Monday, the IRS did not identify a potential source of the crime. But in May, officials said IRS investigators believe the identity thieves are part of a sophisticated criminal operation based in Russia.
In 2012, the IRS sent 655 tax refunds to a single address in Lithuania, and 343 refunds went to a lone address in Shanghai, according to a report by the agency’s inspector general. The IRS has since added safeguards to prevent similar schemes, but the criminals are innovating as well.
The IRS estimated it paid out $5.8 billion in fraudulent refunds to identity thieves in 2013.