Slashdot Mirror
IRS: Personal Info of 100,000 Taxpayers Accessed Illegally
An anonymous reader writes: The Associated Press reports that an online service provided by the IRS was used to gather the personal information of more than 100,000 taxpayers. Criminals were able to scrape the "Get Transcript" system to acquire tax return information. They already had a significant amount of information about these taxpayers, though — the system required a security check that included knowledge of a person's social security number, date of birth, and filing status. The system has been shut down while the IRS investigates and implements better security, and they're notifying the taxpayers whose information was accessed.
There's more to it then that.
There's a section asking questions taken partly from the IRS database, and partly from your credit report. The questions are hard enough that when I did taxes at H and R Block it was not unusual for people to fail the test. In particular the form was very finicky about your address, and god help you getting on the site if you'd misspelled your street name on your tax return. But if I had been a determined hacker with one of those PII databases I probably could have turned a good half of them into transcripts, and used the transcripts to file tax returns. You get a couple tries a day, after all.
BTW, it's currently illegal to use an SSN as a Driver's License number. Has been since 2004:
[Public Law 108-458] "Prohibits Federal, State, and local governments from displaying SSNs, or any derivative thereof, on drivers' licenses, motor vehicle registrations, or other identification documents issued by State departments of motor vehicles."