WASHINGTON — Criminals used stolen data to gain access to past tax returns of more than 100,000 people through an application on the Internal Revenue Service’s website, the agency said on Tuesday.
Using Social Security numbers, birth dates, street addresses and other personal information obtained elsewhere, the criminals completed a multistep authentication process and requested the tax returns and other filings, the I.R.S. said. Information from those forms was used to file fraudulent returns, the I.R.S. said, and the agency sent nearly $50 million in refunds before it detected the scheme.
“We’re confident that these are not amateurs,” John Koskinen, the I.R.S. commissioner, said. “These actually are organized crime syndicates that not only we but everybody in the financial industry are dealing with.”
The agency has opened an investigation into the breach and has temporarily shut down the Get Transcript application, which was used to gain access to the information. Old tax returns are sometimes needed to apply for college loans or mortgages, and taxpayers can still request the records by mail.