IRS Hacked.

Of all the targets available, it really isn’t surprising that hackers would try to gain access to the substantial database of financial information at the IRS.  Unfortunately, a successful breach of the security protocols was accomplished by such hackers beginning in February and into mid-May through the “get transcript” function of the IRS website. 

Ordinarily, for someone to get a transcript through the IRS website, they must enter such personal information to authenticate their identity.  It appears the hackers already had the information needed to satisfy the existing authentication protocols and simply used the system that existed to access the transcripts.  The IRS believes that the needed personal information for the compromised tax accounts was already in the hands of the hackers through the hacking of other databases or identity theft efforts.  As a result, the hackers were able to gain access to social security numbers, dates of birth and home addresses on the IRS system.  Income information would also have been vulnerable. 

Hackers attempted access to approximately 200,000 accounts but only gained access on about half of those attempts. In the next several days, the IRS will be notifying taxpayers that were the subject of the hack attacks by letter and offering one year of free credit monitoring to the 100,000 who had their information compromised.  These letters will not request personal information.  If you receive a letter that does request additional personal information, it may be a further effort at fraud by unscrupulous scam artists. 

Unfortunately, the authentication process in the IRS system is similar to (or even more complex than) that used by various other financial databases with online access.  If the hackers had the information needed to access the IRS system, they can likely get into other systems as well.  If you receive a letter from the IRS that your information was compromised, you should monitor any other online financial accounts and consider changing your login credentials.    

The IRS announcement about the hack can be found here:  IRS statement on data breach.