Hackers stole personal information from 104,000 taxpayers, IRS says

Washington Post ^ | May 26, 2015 | By Lisa Rein and Jonnelle Marte

[Brad from Tennessee]

Hackers gained access to personal information of 104,000 taxpayers this spring, downloading an online service the Internal Revenue Service uses to give Americans access to their past tax returns, the agency said Tuesday.

The information included several years’ worth of returns and other tax information on file with the IRS, Commissioner John Koskinen said in a press conference. The thieves hacked into a system called “Get Transcript,” clearing a security screen that requires users to know the taxpayer’s Social Security number, date of birth, address and tax filing status.

Those who successfully downloaded the transcripts gained access to information from prior years’ tax returns that could be used to file fraudulent tax returns that more closely resemble those of legitimate taxpayers, officials said. Koskinen said the system, which has temporarily been shut down, was targeted from February through mid-May. . .

[i_robot73]

It was NEVER functional to begin. Coupled with a 16th Amendment and enforcement that blatantly tramples upon numerous other Amendments, it has continued to be the attack dog and Socialist camel-nose; all brought to you by human greed, envy and class warfare.

Unfortunately, your ‘flat tax’ is still degrees of above. Starve the beast w/ a consumption tax and watch the People return to frugality, do-at-home/home-grown, etc.

[Nip]

Your number of affected tax payers is low because the IRS deliberately low balled their estimate.

Take a close look at your 1040. If you are married your wife’s data is on there. If you have children, their data is also there.

IMHO the IRS just reported the number of people whose name and identy data appeared on the first line of the 1040 - not all of the dependents included on the form.

Tell me again why we should use the web to accomplish/help with our taxes.

[Engedi]

Right, that part looks ok. It’s when you go to the part to sign up for account to get the transcripts, it asks you for valid email address which sends you a code that you have to use to begin the “transcript process”. The URL that looks funny is when you go to enter the “code” you were sent in an email.

I just tried to click on the “get transcript online” icon and it won’t go to next screen.

[George from New England]

I’m on the Gulf coast in Florida. My small business lost because of BP’s spill in 2009. I refuse to file a claim with BP, cause they not only want my personal SSN and tax return info, they want my wifes SSN and refuse to let me black out my children’s SSN.

I don’t let me SSN out anywhere, why should i trust BP

[SkyDancer]

Hmmm, interesting.

[bgill]

Hey, all those illegal South Americans and Syrians the usurper is bussing in need American IDs.

[LucyT]

If you find out you’re among the 204,000 American taxpayers hit by the data breach disclosed (May 26) by the Internal Revenue Service,

then - you - are in serious trouble.

This is much worse than a typical data breach. — Your identity is actively being used for fraud, — and you need to take action as soon as you get a notice from the IRS.

First, some background: The thieves who hit the IRS between February and mid-May of this year didn’t steal personal information from the tax agency. They already had it. That information was harvested in unspecified earlier data breaches — possibly the massive breaches at health insurers Anthem and Premera disclosed a few months ago, which contained full names, addresses, dates of birth and Social Security numbers of more than 90 million individuals.

MORE: What to Do After a Data Breach

With such information, the IRS “hackers” didn’t have to hack the IRS website. Instead, they walked right in the front door, verifying stolen identities in half of roughly 200,000 attempts. (The other half were stymied by “security” questions, the answers to some of which could have been found on Facebook or Zillow.) Once in, they downloaded transcripts of previous tax filings, which were used to file fraudulent 2014 tax returns that paid out more than $50 million in refunds to crooks.

“These are not amateurs,” IRS Commissioner John Koskinen told The New York Times. “These actually are organized crime syndicates that not only we, but everybody in the financial industry, are dealing with.”

The IRS will mail out letters this week to all 200,000 individuals whose personal information was used. The 100,000 people whose transcripts were fraudulently obtained will be offered free credit monitoring for an unspecified period.

There’s no harm in signing up for the free monitoring, but it won’t be enough. If you get a letter from the IRS about this incident, whether or not a transcript was obtained, then your personally identifiable information is already being exploited by criminals. You’re not at risk of identity theft; your identity has already been stolen.

Here’s what you need to do.

1. Request a fraud alert, also known as a credit alert, on your file with one of the three main credit-reporting agencies. The agency you contact will inform the other two, you’ll get a credit report from each, and it will cost you nothing.

For the next 90 days, you’ll be informed whenever a credit report is run on you (a routine occurrence) and whenever someone tries to open an account in your name (not routine). You can renew the fraud alert every 90 days as many times as you like.

To contact Equifax, call 1-888-766-0008 or go to this Web page. To contact Experian, call 1-888-397-3742 or go here. For TransUnion, the phone number is 1-800-680-7289 and the link is here.

2. Sign up with a good credit-monitoring service, also known as an identity-protection service. “Protection” is a misleading term — what these services do is alert you if something is wrong, and, sometimes, help you resolve issues. Unfortunately, the services you get for free if you’re the victim of a large-scale data breach are among the least impressive we’ve evaluated, doing the bare minimum to keep you informed of possible fraudulent activity.

Instead, it’s worth paying for a solid service, such as LifeLock, IdentityForce and Identity Guard, which we found to be much more useful and thorough. Each offers different tiers of pricing and coverage; it can add up to a lot, but we recommend signing up for at least six months if you’re part of the IRS 204,000.

3. File a police report of identity theft with your local police precinct. This may seem pointless, — but it’s extremely important — because it will establish a legal basis with which you can dispute any future fraudulent activity, and may make you eligible for a free credit freeze (see below).

4. File a formal complaint of identity theft with the Federal Trade Commission, which you can do here, for the same reasons.

5. Consider instituting a credit freeze, also known as a security freeze, with the credit-reporting agencies. You may have to pay a small fee to each agency to both begin and end a credit freeze, although in most states, the fee is waived for persons who have filed police reports of identity theft.

A credit freeze will stop anyone from opening an account in your name without your explicit approval. The downside is that it won’t let anyone run a credit report on you, either — which may snarl things up if you’re trying to buy a house or a car or even to change your cellphone company. Still, because your identity has already been stolen and anything could happen with your data, the inconvenience may be worth the peace of mind.

http://www.tomsguide.com/us/irs-data-breach-what-to-do,news-20974.html

[SZonian]

Bkmk for possible future reference.

Thanks LucyT

[bgill]

will be offered free credit monitoring for an unspecified period

Funding for that doesn't come from the IRS budget. Notice, too, the IRS isn't offering any compensation for lawyers and the headache. Bottom line, no skin off them.

[Incorrigible]

That’s good stuff to know!

[azishot]

Thanks, LucyT. Bookmarking just in case...

[Brad from Tennessee]

bookmark

[the_boy_who_got_lost]

Here is how many SSN’s can be easily hacked:

https://www.linkedin.com/pulse/how-hackers-steal-your-social-security-number-timothy-martens

ssa.gov has very simple security allowing SSN’s to be easily guessed.