IRS Data Breach Larger than Initially Reported, 300,000 People Affected

IRS Data Breach Larger than Initially Reported, 300,000 People Affected
Image: NCCC
August 18, 2015

A data breach that affected the Internal Revenue Service (IRS) is larger than originally thought, officials announced this week.

After further analysis the agency says that more than 300,000 taxpayers are a part of the breach, which was first announced in May. Initially, the IRS believed that data for 114,000 people was stolen, but an additional 220,000 have been identified. Hackers tried to steal data for another 280,000 more taxpayers, but failed.

Potential victims will be notified by the IRS, which is offering free credit monitoring services. Victims can also be enrolled in a program that assigns them a special ID number to be used when they file their tax returns.

The sophisticated crime is thought to be the work of hackers based in Russia, but the IRS has not determined the official cause. Hackers took advantage of a system that allows taxpayers to get old copies of their tax returns. A multi-step authentication process is required that includes knowledge of personal information, like date of birth and Social Security number, as well as the answers to detailed security questions.

Having old tax returns makes it easier for criminals to file fraudulent returns in the future.

The Associated Press reports that the IRS is no stranger to fraudulent returns. In 2013 the IRS paid out an estimated $5.8 billion in fraudulent refunds. In 2012, 655 tax refunds when to a single address in Lithuania, and 343 refunds were sent to Shanghai. Safeguards have since been put in place to prevent similar schemes.

IRS Scammers Target Taxpayers

Tax season is over, but scammers continue to claim they're IRS agents in search of back taxes. Scammers often reach out to victims via phone, email, or official-looking letterhead and demand that taxpayers pay what they owe using a credit card, prepaid debit card, or even direct deposit at a local bank.

Don't fall for it.

REMEMBER, the IRS will never:

  • Angrily demand immediate payment over the phone, nor will the agency call about taxes owed without first having mailed you a bill.
  • Threaten to bring in local police or other law-enforcement groups to have you arrested for not paying.
  • Demand that you pay taxes without giving you the opportunity to question or appeal the amount they say you owe.
  • Require you to use a specific payment method for your taxes, such as a prepaid debit card.
  • Ask for credit or debit card numbers over the phone.

Here's what you should do if you think you're the target of an IRS impersonation scam:

  • If you actually do owe taxes, call the IRS at (800) 829-1040. IRS workers can help you with a payment issue.
  • If you know you don't owe taxes or do not immediately believe that you do, you can report the incident to the Treasury Inspector General for Tax Administration (TIGTA) at (800) 366-4484.
  • If you've been targeted by any scam, be sure to contact the Federal Trade Commission (FTC) and use their "FTC Complaint Assistant" at FTC.gov. Please add "IRS Telephone Scam" to the comments of your complaint.