Slashdot Mirror
IRS: Personal Info of 100,000 Taxpayers Accessed Illegally
An anonymous reader writes: The Associated Press reports that an online service provided by the IRS was used to gather the personal information of more than 100,000 taxpayers. Criminals were able to scrape the "Get Transcript" system to acquire tax return information. They already had a significant amount of information about these taxpayers, though — the system required a security check that included knowledge of a person's social security number, date of birth, and filing status. The system has been shut down while the IRS investigates and implements better security, and they're notifying the taxpayers whose information was accessed.
That's all the ID the IRS requires to use their "secure" site???
Jaysus, you can get most of that (SSN & DoB) by looking at someone's Driver License in most States.
And guessing Married Filing Jointly will work more often than not, I expect....
"I do not agree with what you say, but I will defend to the death your right to say it"
This took a lot longer to happen than I thought it should've.
In order to access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address.
In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles.
Email doesn't go through a "security screen". Do they mean "questionable IP addresses" rather than "email domains"?
Those affected should be able to sue, there needs to be accountability.
I am Bennett Haselton! I am Bennett Haselton!
[NEWS_OUTLET] reports that an online service provided by [ORGANIZATION_WITH_PERSONAL_DATA] was used to gather the personal information of [CUSTOMERS_OR_USERS]. Criminals were able to scrape [INSECURE_SYSTEM] to acquire [SUPPOSEDLY_SECURED_INFORMATION]. The system has been shut down while [OVERPAID_AND_INCOMPETENT_ANALYSTS] investigate and [PROMISE], and they're notifying [CUSTOMERS_OR_USERS] whose information was accessed.
At this point, you can turn this story into a Mad Lib, and fill in the blanks with basically any set of nouns, and it'll mostly be true.
This is actual even more serious than it sounds since the IRS basically gave the criminal a mean of mass validating their existing data. They have in effect proven valid SSN/Birthday pairs now ready to be used and abused.
The existence of this system was reported previously on slashdot, and people were recommending that you sign up before a criminal signs up in your name. That way you can protect the account with your own strong password.
Which is exactly what I did. And I am now quite happy I did. And I don't mind a bit that they shut it down anyway.
I hope they don't think I was one of the MFers that did this. I have been checking my transcript regularly to make sure a correction to an incorrectly filled out form was made and I can finally get my refund.
They probably acessed the transcript to obtain this number. The AGI would not be in other identity leaks like SSN, DOB and address.
That does it. I'm going to quit giving them my business.
I'm an American. I love this country and the freedoms that we used to have.
Yes, you! The guy fucking with the layout again, indenting replies with an inch of white space and letting the beta bullshit leak into slashdot classic. Stop that! How many fucking times do we have to riot to get you to stop shitting up the comments section with bullshit useless whitespace?
Unless you're in the market for something you cannot pay for in cash or with the current line of credit, your credit must be frozen. This solution costs about $30 ($10 per freeze x 3 agencies) and that is a small price to pay for a reduced risk of a stolen identity. This is due to the fact that in many cases your financial history is used to verify your identity and a credit freeze makes the financial history unavailable. For example, if you try to register for an IRS account while having a credit freeze, the system will deny your request. You can lift the freeze any time you want.
I'm in the process of dealing with something like that now: someone filed a tax return for me before I got around to it. As a result, I had to file on paper, including an "identity theft affidavit" and a copy of some id, but they still sent back a letter requiring me to verify my identity. The online system rejected me (probably because it was asking for information on the fraudulent return), requiring me to call in. After wading through a 5 minute phone tree to get to a human, the system says "sorry, we're too busy go away". OK, it doesn't say "go away" but says call back later and hangs up, which is effectively the same. In the future, I will definitely be using the system to get a PIN ahead of time... If I owed money, I'd probably say fine - if you don't want to talk to me, I don't care, but sadly that's not the case...
If congressional Republicans had a spine, Ms. Lerner would be occupying a cell in Leavenworth.
Yea, /. had a story about the IRS and SS sites a while back.
Make sure your log in and create an account for the Social Security Administration too.
It really is getting ridiculous how frequent this shit is happening now.
It's almost to the point where people don't even pay attention:
"Oh wow, another big financial institution got hacked... Another fifty million Americans data is in the hands of criminals... What can we do about it?"
The average American is at their wits fucking end trying to keep up with all their accounts, passwords, blah diddy fucking blah shit they have to keep track of. For most of us this isn't an issue, but you can guarantee that for the vast majority of Americans, they are flying blind when it comes to all various requirements for being secure online. Oh, and lest I forget(how could I?) all of these security problems we encounter daily are always for convenience of the user(Trust Us!). Convenient apps/plugins/sites/tools to make your life easier:
"Isn't your life easier with our no security, pro-hacker enabled widget? Why, within a matter of moments of using our widget your personal data, financial data and medical data will be in the hands of our trusty hacker/malware infested servers in DerkaDerkaStan, where our trusty staff of well trained consultants will bleed you dry before you can click the X in the upper right hand corner. Why, to deny such a widget would be an affront to America, to the very meaning of Freedom and Capitalism!"
To be less hyperbolic, think of what it takes to have even a modicum of security online. We've got to have hardened browsers(NoScript, AdBlock, etc), we have to have different id/pw combinations for all important sites(that one really messes with people...), we have to have an account with a credit monitoring/credit agency(Equifax, etc) to monitor our financial accounts, we have to have up to date settings, firmware on our DSL/Cable modems, we have to have our OS security settings correct, AV/AntiMalware, etc, etc, etc
Have fun with all that, average American(it's bad enough for "advanced" users).
We play the game with the bravery of being out of range
You can't even officially renounce your citizenship without going to another country and renouncing it at an official government building there.... and you need to buy a U.S. passport to do that. So much for "Land of the Free".
I'm an American. I love this country and the freedoms that we used to have.
She couldn't find the emails because the HACKERS had destroyed her hard drive!
Yet, no one get's fired. No one is held accountable. The organization continues to operate as a political operative.
simplify the tax code, institute a flat tax, abolish the bloated corrupt bureaucracy that is the IRS
although I for one welcome our kinder gentler overlords at the IRS that I'm sure will come out of this obvious example of incompetence /duck and run
It ain't what they call you. It's what you answer to. http://mylyceum.us/
Everyone sue the IRS! That'll teach them! Oh wait, you can't. Tough luck, buddy. Just keep trusting your government though-- because you really have no choice.
Gamingmuseum.com: Give your 3D accelerator a rest.
I used this system to get a reprint of last year's form, lost to a hard drive crash (yes, I know, backups). How can anyone distinguish legitimate from illegitimate access?