IRS says hackers gained access to tax returns, other info of more than 100K taxpayers by targeting “Get Transcript” service and using SSNs, birth dates, more
APNewsBreak: IRS says thieves stole tax info from 100,000 — WASHINGTON (AP) — Thieves used an online service provided …
Context & Ripple Effects
The IRS's Get Transcript service was built for taxpayer convenience, but it authenticated users with exactly the data identity thieves already had in bulk from prior breaches — Social Security numbers and birth dates. The agency initially put the damage at more than 100,000 taxpayers' returns, and reporting the next day traced the theft's origins to Russia.
What makes this story an arc rather than an incident is what followed: within a year the IRS disclosed that over 700,000 accounts were accessed, more than double its August estimate, thieves separately pulled 100,000 electronic filing PINs from another IRS system, and in 2017 hackers struck again through a student financial aid tool, each time converting legitimately issued credentials into fraudulent refund claims.
First-order effects
- More than 100,000 taxpayers whose transcripts were pulled now face elevated risk of fraudulent refund filings in their name, since the stolen returns contain the exact data needed to impersonate them.
- The IRS must notify affected taxpayers and harden Get Transcript — a self-service tool it will likely restrict or add friction to, degrading convenience for legitimate filers immediately.
Second-order effects
- With one federal credential system breached via purchased identity data, every other government service authenticating on SSNs and birth dates — including the student aid portal hit two years later — inherits the same attack surface and must respond.
- Tax-prep and e-filing providers face more fraudulent-return attempts flowing through their systems, shifting fraud-detection costs from the IRS onto the private filing ecosystem and its customers.
Third-order effects
- A pattern of successive breaches across distinct IRS services points toward regulators treating knowledge-based authentication itself as the vulnerability, forcing a move to out-of-band verification for any system that touches tax data.
- If refund fraud keeps scaling through stolen-identity pipelines, pressure builds for structural fixes — return pre-population, IRS-side verification before payouts — that change how refunds are issued rather than just how accounts are logged into.
The trend: Government online services that authenticate citizens with already-public identity data are being systematically harvested, pushing agencies toward abandoning knowledge-based authentication altogether.