Identity thieves used the Internal Revenue Service’s online service to obtain tax return information for about 100,000 U.S households, the tax agency said Tuesday.
The IRS said criminals used stolen Social Security numbers and other data to gain unauthorized access to the accounts. Of the 200,000 attempts, 100,000 were successful.
The IRS said thieves used the information from prior years’ returns to help them file for fake refunds. They did it by accessing a system called “Get Transcript,” where they had to clear a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address.
"The IRS notes this issue does not involve its main computer system that handles tax filing submission; that system remains secure," the agency said in a statement.
The IRS said thieves targeted the system from February to mid-May. The service has been temporarily shut down.
"In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles," the agency said. "During this filing season, taxpayers successfully and safely downloaded a total of approximately 23 million transcripts."
Tax returns can include a host of personal information that can help someone steal an identity, including Social Security numbers and birthdates of dependents and spouses. However, the IRS said the thieves appeared to already have a lot of personal information about the victims.
“Taxpayers must know that the information they send to the IRS is secure,” Senate Finance Committee Chairman Orrin Hatch, R-Utah, said in a written statement following the announcement. “And hackers who would steal that information must know that they will suffer severe consequences for their crimes.”
The IRS said it is notifying taxpayers whose information was accessed.
The Associated Press contributed to this report.