In hindsight: Government monitors repeatedly warned of IRS computer security risks long before Tuesday’s disclosure that identity thieves had stolen tax agency data for roughly 100,000 U.S. households. USA Today reports at least seven federal audits and other reports from 2007 to 2014 outlined dangers that ranged from failures in IRS database controls to hiring an ex-con without a background check and failing to screen for other workers who had access to personal data for millions of taxpayers. “Computer security has been problematic for the IRS since 1997,” according to an October 2014 report by the Treasury Inspector General for Tax Administration, the government monitor for the nation’s tax agency. TIGTA has ranked security for taxpayer data and IRS employees as among the tax agency’s top management challenges every year at least since 2004. Read the full story.
From a foreign window: IRS investigators believe the identity thieves who stole the personal tax information of more than 100,000 taxpayers from an IRS website are part of a sophisticated criminal operation based in Russia, two officials have told the Associated Press. The information was stolen as part of an elaborate scheme to claim fraudulent tax refunds, IRS Commissioner John Koskinen told reporters. Koskinen declined to say where the crime originated. But The AP reports two officials briefed on the matter say the IRS believes the criminals were in Russia, based on computer data about who accessed the information. The officials spoke on condition of anonymity because they were not authorized to discuss publicly the ongoing criminal investigation. Read the full story.
Further on up the road: The plot to steal information on 100,000 taxpayers from the IRS and hijack nearly $50 million in refunds not only reveals a previous security breach but also hints at a wider fraud that may bedevil Americans in the future. The New York Times reports some security and tax experts warn that this latest data theft might be a prelude to more targeted schemes aimed at duping taxpayers into handing millions of dollars over to criminals or to help thieves circumvent the agency’s security filters next year and beyond. “This breach is not just about what this single group is going to do with the information, but what happens when this information gets sold on the black market,” says Peter Warren Singer, the author of Cybersecurity and Cyberwar: What Everyone Needs to Know. “It’s rare for the actual attackers to turn the information directly into money. They’re stealing the data and selling it off to other people.” Read the full story.
