IRS commissioner: 100K taxpayers potentially compromised in online data breach

Upwards of 100,000 taxpayers may have had their personal information compromised by an online security breach, the head of the IRS said.

Testifying Thursday before the Senate Finance Committee, IRS Commissioner John Koskinen said identity thieves exploited a bug within one of its web-based data tools to file millions of dollars’ worth of fraudulent tax returns.

“Fortunately we caught this at the front end,” Mr. Koskinen said at the hearing. “Our highest priority is making sure that we protect taxpayers and their identity.”

The agency’s “data retrieval tool” is designed to import financial records between the IRS and the Department of Education’s website to help taxpayers completing a lengthy college financial aid form know as the Free Application for Federal Student Aid, or FAFSA. According to the commissioner, however, criminals harnessed a security flaw within the tool to steal other people’s data and then file and collect false tax returns.

The IRS disabled the tool last month, Mr. Koskinen said Thursday, but not before the agency issued about 8,000 fraudulent tax returns totaling roughly $30 million. Another 14,000 bogus returns were spotted by investigators before refunds were issued, and another 52,000 filings were halted altogether, he said.

More