IRS: Personal Info of 100,000 Taxpayers Accessed Illegally

An anonymous reader writes: The Associated Press reports that an online service provided by the IRS was used to gather the personal information of more than 100,000 taxpayers. Criminals were able to scrape the "Get Transcript" system to acquire tax return information. They already had a significant amount of information about these taxpayers, though — the system required a security check that included knowledge of a person's social security number, date of birth, and filing status. The system has been shut down while the IRS investigates and implements better security, and they're notifying the taxpayers whose information was accessed.

Comments

DoB, SSN & Filing Status??

[CrimsonAvenger]

That's all the ID the IRS requires to use their "secure" site???

Jaysus, you can get most of that (SSN & DoB) by looking at someone's Driver License in most States.

And guessing Married Filing Jointly will work more often than not, I expect....

Re:DoB, SSN & Filing Status??

[pehrs]

Say after me ten times: Identity is not Authentication, nor Authorization. Identity is not Authentication, nor Authorization. Identity is not...

Now, got that? You are making the same sad mistake that the IRS did. You are confusing Identity with Authentication.

SSN & DoB are perfectly fine identifiers for a person. Not quite unique, but they will work for the purpose.

The problem is that there is no authentication, nor any authorization infrastructure for them to use as far as I know. There are in other countries (see for example https://www.bankid.com/en/). I have understood that there are ideological reasons not to roll out a decent Authentication/Authorization infrastructure in the US, but the lack of such an infrastructure will cost US business (and private person) more and more dearly as important information moves to the internet.

Re:DoB, SSN & Filing Status??

[Charliemopps]

That's all the ID the IRS requires to use their "secure" site???

Jaysus, you can get most of that (SSN & DoB) by looking at someone's Driver License in most States.

And guessing Married Filing Jointly will work more often than not, I expect....

I know, it's hilarious. These agencies/companies get hacked due to their own willful negligence... then scream "Hackers did it!" like hackers have magic hacking wands that turn servers inside out. It seems that the only piece of info that would have been remotely hard to get was filing status... which the "hackers" just guessed at. It looks like they were 50% successful, and I bet if compared with the victims filing status, they likely had a 50% chance of filing jointly or something. What a joke. This is completely and entirely the IRS's fault.

Make a new law, if you get hacked, you have to pay the person whos data you lost $100,000. Problem solved. You can then decide if spending time on securing the data is worth it, or if you just want to not store it. It IS possible to prevent this sort of thing. These agencies and companies just don't think it's profitable to do so when the penalty for losing a persons info is nothing more than a press release.

Re:DoB, SSN & Filing Status??

[ShanghaiBill]

No-one should have your SSN beyond the government.

That is silly. The original point of SSNs was so that employers could use them to identify workers when paying social security taxes to the government. So, obviously, your employer needs to know it.

We need to get away from the ridiculous idea that something can be both widely known and secret. SSNs should only be used for identification, and should never be used for authentication. We should have a separate system for that.

Re:DoB, SSN & Filing Status??

[NicBenjamin]

There's more to it then that.

There's a section asking questions taken partly from the IRS database, and partly from your credit report. The questions are hard enough that when I did taxes at H and R Block it was not unusual for people to fail the test. In particular the form was very finicky about your address, and god help you getting on the site if you'd misspelled your street name on your tax return. But if I had been a determined hacker with one of those PII databases I probably could have turned a good half of them into transcripts, and used the transcripts to file tax returns. You get a couple tries a day, after all.

BTW, it's currently illegal to use an SSN as a Driver's License number. Has been since 2004:
[Public Law 108-458] "Prohibits Federal, State, and local governments from displaying SSNs, or any derivative thereof, on drivers' licenses, motor vehicle registrations, or other identification documents issued by State departments of motor vehicles."

Mad Lib

[Voyager529]

[NEWS_OUTLET] reports that an online service provided by [ORGANIZATION_WITH_PERSONAL_DATA] was used to gather the personal information of [CUSTOMERS_OR_USERS]. Criminals were able to scrape [INSECURE_SYSTEM] to acquire [SUPPOSEDLY_SECURED_INFORMATION]. The system has been shut down while [OVERPAID_AND_INCOMPETENT_ANALYSTS] investigate and [PROMISE], and they're notifying [CUSTOMERS_OR_USERS] whose information was accessed.

At this point, you can turn this story into a Mad Lib, and fill in the blanks with basically any set of nouns, and it'll mostly be true.

Very Serious

[Anonymous Coward]

This is actual even more serious than it sounds since the IRS basically gave the criminal a mean of mass validating their existing data. They have in effect proven valid SSN/Birthday pairs now ready to be used and abused.

Yeah

[Anonymous Coward]

The existence of this system was reported previously on slashdot, and people were recommending that you sign up before a criminal signs up in your name. That way you can protect the account with your own strong password.

Which is exactly what I did. And I am now quite happy I did. And I don't mind a bit that they shut it down anyway.

Re:Yeah

[ChromaticDragon]

So did I.

But then I stopped and thought a bit about the concept of Testing for Success vs. Testing for Failure. The former is weak testing... lazy testing. It WORKS. That's nice... But does it fail as it should? Have you tested when and how it fails? Do you know the limits?

So... I decided to act as an identify thief. As previously reported then and now, getting the credentials to sign up are easy. OK. But I had already signed up. So that'd protect me, right?

NOT AT ALL.

It was trivially easy to sign up again. Oh sure, an email gets sent to the first email address set up. But this leads to one of two situations. First, the proper user doesn't check his email for a while. Then whatever the thief is going to do they can do. Second, the proper users finds out immediately and gets on and takes it back over. All good? Comically, no. Believe it or not (and I was really stunned at this part) the webapp doesn't force logout the identity thief when the proper user reregisters.

I was a tad sickened at this point.

As far as I could tell, this was utterly and completely insecure. The only way for an "average joe" to protect themself here was to sign up and then freeze credit completely at all the credit bureaus. Supposedly (haven't finished this part yet) once you do that, the 20-question stuff will IMMEDIATELY fail and anything like this IRS.GOV site that depends on it will also fail.

Oh... but it was rather interesting to see what the IRS had stored on me... and what they didn't have. It was somewhat perplexing.

Last Straw

[frovingslosh]

That does it. I'm going to quit giving them my business.

It's not just the IRS

[Sir_Eptishous]

Yea, /. had a story about the IRS and SS sites a while back.
Make sure your log in and create an account for the Social Security Administration too.

It really is getting ridiculous how frequent this shit is happening now.
It's almost to the point where people don't even pay attention:
"Oh wow, another big financial institution got hacked... Another fifty million Americans data is in the hands of criminals... What can we do about it?"

The average American is at their wits fucking end trying to keep up with all their accounts, passwords, blah diddy fucking blah shit they have to keep track of. For most of us this isn't an issue, but you can guarantee that for the vast majority of Americans, they are flying blind when it comes to all various requirements for being secure online. Oh, and lest I forget(how could I?) all of these security problems we encounter daily are always for convenience of the user(Trust Us!). Convenient apps/plugins/sites/tools to make your life easier:
"Isn't your life easier with our no security, pro-hacker enabled widget? Why, within a matter of moments of using our widget your personal data, financial data and medical data will be in the hands of our trusty hacker/malware infested servers in DerkaDerkaStan, where our trusty staff of well trained consultants will bleed you dry before you can click the X in the upper right hand corner. Why, to deny such a widget would be an affront to America, to the very meaning of Freedom and Capitalism!"

To be less hyperbolic, think of what it takes to have even a modicum of security online. We've got to have hardened browsers(NoScript, AdBlock, etc), we have to have different id/pw combinations for all important sites(that one really messes with people...), we have to have an account with a credit monitoring/credit agency(Equifax, etc) to monitor our financial accounts, we have to have up to date settings, firmware on our DSL/Cable modems, we have to have our OS security settings correct, AV/AntiMalware, etc, etc, etc

Have fun with all that, average American(it's bad enough for "advanced" users).