![\"IRS,](\"https:\/\/hcsblogdotorg.files.wordpress.com\/2016\/02\/irs.jpg\")
<\/p>\n<\/p>\n
WHEN THE IRS <\/span>first reported a hack that exposed taxpayer accounts\u2019 vulnerable information, it pegged the number of affected people at a little over 100,000. Today, in its second upward revision, the number of affected people now stands at over 700,000<\/strong><\/em>.<\/p>\n As WIRED originally reported<\/a> last spring, the hack gave attackers access to entire tax returns, which means people\u2019s social security numbers, address, and incomes were all compromised. The hackers used personal information already in hand to get unauthorized access through an IRS application called \u201cGet Transcript.\u201d<\/p>\n In other words, much of the information had already been acquired, including SSNs and dates of birth. \u201cGet Transcript\u201d has been offline since the first indications of a breach last May.<\/p>\n The initial IRS report indicated that 114,000 accounts had been compromised. It revised that number last August, raising it to 334,000. On Friday, the IRS added another 390,000 accounts to the pile, for a total of well over 700,000 people. There have also been a total of 500,000 targeted, but failed, attempts at access.<\/p>\n The IRS will begin mailing affected taxpayers from this most recent batch starting February 29th. If you\u2019re one of them, you also qualify for free Equifax identity theft protection for one year, and \u201cextra scrutiny\u201d on tax returns associated with your SSN.<\/p>\n In terms of the type of information that\u2019s been compromised, it\u2019s no worse than it was last May. That\u2019s still plenty bad, though; if there\u2019s information about yourself you might consider sensitive, it\u2019s probably on your tax return somewhere.<\/p>\n What\u2019s more serious at this point is the extent to which the IRS underestimated the severity of the breach. It\u2019s been nearly a year. That\u2019s a long time for 390,000 people to have been vulnerable but not know it.<\/p>\n The revelations come at the end of a nine-month investigation by the Treasury Inspector General for Tax Administration, which hopefully means that it\u2019s the last of upward revisions. The IRS also notes that not all of these cases necessarily involve malevolent actors.<\/p>\n \u201cTIGTA investigators identified suspicious email addresses that made multiple attempts to access accounts,\u201d the agency said in a\u00a0statement<\/a> today. \u201cIt is possible that some of those identified may be family members, tax return preparers, or financial institutions using a single email address to attempt to access more than one account.\u201d<\/p>\n For now, just keep an eye on your mailbox next week. And if you have a notice from the IRS, brace yourself for the very real possibility of identity theft.<\/p>\nThe Hack<\/h3>\n
Who\u2019s Affected<\/h3>\n
How Serious Is This?<\/h3>\n