IRS: Taxpayer breach larger than first reported

The IRS acknowledged Monday that a recent computer breach was larger than first reported, saying that hundreds of thousands of additional taxpayers saw their sensitive information compromised.

The tax agency said that thieves might have swiped information on another 220,000 taxpayers as part of a scheme first revealed in May. Another 170,000 attempts to steal taxpayer information were unsuccessful. 

{mosads}In all, the new information means that the breach was at least more than twice as big as originally reported. 

The IRS said in May that thieves were successful in getting access to 114,000 sets of taxpayer information and were blocked another 111,000 times. On Monday, the IRS said that it found the almost 400,000 other attempts after a deeper dive that analyzed more than 23 million uses of IRS systems.

In a statement, the IRS said it was “moving aggressively to protect taxpayers whose account information may have been accessed.”

The IRS is offering taxpayers whose information were compromised free credit monitoring, as well as other protections. The agency is also contacting all 390,000 of the households who they most recently discovered were targeted, warning taxpayers even when identity thieves were unable to break into IRS systems.

Cyber thieves were able to break through the IRS’s “Get Transcript” system, which houses previous tax returns and other sensitive information. The agency shut down the system in May, after the breach was first discovered.

From the start, the IRS has said the thieves used more detailed personal information beyond just a Social Security number or date of birth — like a mortgage or car payment — to get into the “Get Transcript” system. 

IRS officials also believe that the thieves’ efforts this year were part of a broader scheme to steal refunds during next year’s filing season. 

In its Monday statement, the agency also suggested that thieves might not have been behind all of the 220,000 uses of the “Get Transcript” system but didn’t say how many accounts were compromised.