More than 100,000 people had their personal information stolen from an Internal Revenue Service database.
The IRS said criminals took advantage of the agency’s online “get transcript” service, which allowed people to download several years of tax returns. Between February and May, a group successfully used the service about 104,000 times.
They downloaded forms full of personal information, like annual income, addresses, and social security numbers. The group then used the information to claim the tax refunds of some 15,000 people.
The IRS has since disabled the “get transcript” service, and will be sending out letters to the 100,000 affected taxpayers as well all taxpayers that had an attempted access that was prevented due to a failed authentication test. The IRS emphasizes these outreach letters will not request any personal identification information from taxpayers. These letters will be mailed out starting later this week.
The IRS will be offering free credit monitoring for the approximately 100,000 taxpayers whose accounts were accessed.
The agency blames a “sophisticated” organized crime syndicate for the attack. It’s reaching out to victims and offering to pay for credit protection services.
Identity thieves, both foreign and domestic, have stepped up their efforts in recent years to claim fraudulent tax refunds. The IRS estimates it paid out $5.8 billion in fraudulent refunds to identity thieves in 2013. the agency was alerted to the thieves when technicians noticed an increase in the number of taxpayers seeking transcripts.
The IRS said its main computer system, which handles tax filing submissions, remains secure.