Slashdot Mirror
IRS: Personal Info of 100,000 Taxpayers Accessed Illegally
An anonymous reader writes: The Associated Press reports that an online service provided by the IRS was used to gather the personal information of more than 100,000 taxpayers. Criminals were able to scrape the "Get Transcript" system to acquire tax return information. They already had a significant amount of information about these taxpayers, though — the system required a security check that included knowledge of a person's social security number, date of birth, and filing status. The system has been shut down while the IRS investigates and implements better security, and they're notifying the taxpayers whose information was accessed.
That's all the ID the IRS requires to use their "secure" site???
Jaysus, you can get most of that (SSN & DoB) by looking at someone's Driver License in most States.
And guessing Married Filing Jointly will work more often than not, I expect....
"I do not agree with what you say, but I will defend to the death your right to say it"
In order to access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address.
In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles.
Email doesn't go through a "security screen". Do they mean "questionable IP addresses" rather than "email domains"?
[NEWS_OUTLET] reports that an online service provided by [ORGANIZATION_WITH_PERSONAL_DATA] was used to gather the personal information of [CUSTOMERS_OR_USERS]. Criminals were able to scrape [INSECURE_SYSTEM] to acquire [SUPPOSEDLY_SECURED_INFORMATION]. The system has been shut down while [OVERPAID_AND_INCOMPETENT_ANALYSTS] investigate and [PROMISE], and they're notifying [CUSTOMERS_OR_USERS] whose information was accessed.
At this point, you can turn this story into a Mad Lib, and fill in the blanks with basically any set of nouns, and it'll mostly be true.
This is actual even more serious than it sounds since the IRS basically gave the criminal a mean of mass validating their existing data. They have in effect proven valid SSN/Birthday pairs now ready to be used and abused.
The existence of this system was reported previously on slashdot, and people were recommending that you sign up before a criminal signs up in your name. That way you can protect the account with your own strong password.
Which is exactly what I did. And I am now quite happy I did. And I don't mind a bit that they shut it down anyway.
Those affected should be able to sue, there needs to be accountability.
While I agree 100%, we're talking about the US government here. Nobody will be fired. Nothing will change.
"A plan fiendishly clever in its intricacies"- Homer Simpson
That does it. I'm going to quit giving them my business.
I'm an American. I love this country and the freedoms that we used to have.
Yea, /. had a story about the IRS and SS sites a while back.
Make sure your log in and create an account for the Social Security Administration too.
It really is getting ridiculous how frequent this shit is happening now.
It's almost to the point where people don't even pay attention:
"Oh wow, another big financial institution got hacked... Another fifty million Americans data is in the hands of criminals... What can we do about it?"
The average American is at their wits fucking end trying to keep up with all their accounts, passwords, blah diddy fucking blah shit they have to keep track of. For most of us this isn't an issue, but you can guarantee that for the vast majority of Americans, they are flying blind when it comes to all various requirements for being secure online. Oh, and lest I forget(how could I?) all of these security problems we encounter daily are always for convenience of the user(Trust Us!). Convenient apps/plugins/sites/tools to make your life easier:
"Isn't your life easier with our no security, pro-hacker enabled widget? Why, within a matter of moments of using our widget your personal data, financial data and medical data will be in the hands of our trusty hacker/malware infested servers in DerkaDerkaStan, where our trusty staff of well trained consultants will bleed you dry before you can click the X in the upper right hand corner. Why, to deny such a widget would be an affront to America, to the very meaning of Freedom and Capitalism!"
To be less hyperbolic, think of what it takes to have even a modicum of security online. We've got to have hardened browsers(NoScript, AdBlock, etc), we have to have different id/pw combinations for all important sites(that one really messes with people...), we have to have an account with a credit monitoring/credit agency(Equifax, etc) to monitor our financial accounts, we have to have up to date settings, firmware on our DSL/Cable modems, we have to have our OS security settings correct, AV/AntiMalware, etc, etc, etc
Have fun with all that, average American(it's bad enough for "advanced" users).
We play the game with the bravery of being out of range
That's what we did when my identity was stolen. My name, address, SSN, and DOB were used to open a card in my name. I was lucky and the credit card company sent it to me (due to the thieves paying for rush delivery) instead of processing the address change and sending it to the thieves. It's a pain when I want to use my credit (refinance mortgage, buy a car, etc), but most days I don't need to touch my credit and don't want anyone else touching it either.
Of course, the credit agencies don't like when you freeze your credit. Frozen credit files are less profitable (can't sell them to credit card companies hawking even more lines of credit) and so they like pushing "fraud alerts" instead. These expire every 90 days unless you renew them and are voluntary. If I were a credit card company opening a line of credit on someone, it's recommended that I check the fraud alert, but I could just ignore it, open the credit line, and suffer no consequences.
To credit agencies and credit card companies, identity theft is an inconvenience that you just write off. No big deal. To the victim, though, it's a horrible experience. I felt completely violated knowing that someone was walking around with my private information, pretending to be me, and doing their best to run up a huge tab to send my way.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
If you owed money you'd have to send it in anyway. Identity theft is not gonna get you out of the failure to pay penalty.
Keep in mind all this would go away if we were just willing to wait for our tax refunds. He beats you to the IRS? Who cares -- by May they will have the correct income documents so they'll know which one of you is you and which is the fraudster. But since we have to have our money NOW we deal with fraud.
OTOH, since we basically run our Welfare State through the tax system (ObamaCare is technically an income tax subsidy, the Earned income Credit is the major cash benefit we give poor people, much of our higher education subsidy is the American Opportunity Credit, etc.) many of them genuinely need the money as quickly as possible. But the tradeoff for getting them the money quickly is that fraudsters can claim those credits quickly and get paid quickly.