Live data from Hacker News

IRS says thieves stole tax info from 100,000

washingtonpost.com

71–80 of 106 posts

Re: IRS says thieves stole tax info from 100,000

#71
post #54
post #21

I started "working" a few hours a week teaching programming at my kids' school. When they put me on the payroll I was astounded by the number of forms I had to fill out. I counted 15 forms requiring my signature, no less than 5 of which required my SSN. Lo and behold, there was a data breach of employee and volunteer records. Volunteers had to have background checks, which required the SSN. Thousands of people had th…

You can look at it from the other side too, maybe Americans are putting too much weight on the SSN. I could practically post my Spanish ID number next to my name online and nothing would probably happen. As a matter of fact, a stupid regional government agency posted it next to my name in 2011 and it's been up ever since.

If you properly protect your security number, which requires some monthly commitment (such as $15 lifelock, or freecreditreport $5 per month), you can pretty much post your SSN online and really not much will happen. Any time someone uses it, you will get the alert and chance to act (stop the inquiry before it hit hard).

It just that most people believe that not making their SSN public is enough for it to be safe.

Re: IRS says thieves stole tax info from 100,000

#72
post #35

Imagine if all government software was open source and significant bug reports and contributions were rewarded with cash... I hope we reach some happy medium between that and what we have today in the future.

This wasn't a hack or a bug - open source software built to do the same thing would've been just as vulnerable to this.

Per the article, the attackers had to put "the taxpayer’s Social Security number, date of birth, address and tax filing status" into a form to get access.

Re: IRS says thieves stole tax info from 100,000

#73
post #54

Earlier quoted context omitted.

You can look at it from the other side too, maybe Americans are putting too much weight on the SSN. I could practically post my Spanish ID number next to my name online and nothing would probably happen. As a matter of fact, a stupid regional government agency posted it next to my name in 2011 and it's been up ever since.

If you properly protect your security number, which requires some monthly commitment (such as $15 lifelock, or freecreditreport $5 per month), you can pretty much post your SSN online and really not much will happen. Any time someone uses it, you will get the alert and chance to act (stop the inquiry before it hit hard). It just that most people believe that not making their SSN public is enough for it to be safe.

Don't think lifelock will prevent fraudulent tax returns.

Re: IRS says thieves stole tax info from 100,000

#74

Earlier quoted context omitted.

It's their fault because the information needed is widely available.

It's the fault of Congress that they need that information. http://en.wikipedia.org/wiki/Tax_Reform_Act_of_1986

It's the people's fault because they elected the Congress.

Re: IRS says thieves stole tax info from 100,000

#75
post #5

Krebs wrote about this in March: http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before... He has some good advice; claim your account before someone else does.

I think the system used to claim your account is the one that had data stolen from it.

Our luck ... our data was stolen in the Anthem fiasco and used to submit fraudulent returns. No problem. The IRS contacted us to let us know and asked us to use the verification system to prove we were ourselves.

I cannot wait for the auto notification we were part of this data issue. lol

What I cannot understand about the issue is no one noticed a 50% failure rate in the process.

Re: IRS says thieves stole tax info from 100,000

#76

Something is wrong with the wording here. Thieves stole the tax info of 100,000 but they stole it from the IRS. Make no mistake: IRS needs to be held responsible for this. It is their fault.

So when the victim is someone you don't like, it's somehow their fault??

The fault should be with the person/people that stole the tax information, not the IRS.

Blaming the IRS would be like blaming a home owner for not installing a good enough security system when they get robbed instead of the criminals.

Re: IRS says thieves stole tax info from 100,000

#77
post #28

Earlier quoted context omitted.

As a french citizen, and on behalf of everybody I know who doesn't live in the US (and some that do), the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous.

Someone fraudulently used my social security number. It is such a sick and terrible feeling knowing that your number is "out there" and can be used by anyone for a whole host of things. It feels horrible and really, really violating.

And worse, there's no way to rotate it that I know of, so it's like having your password leak and being unable to change it. It's out there forever.

Re: IRS says thieves stole tax info from 100,000

#78
post #54

Earlier quoted context omitted.

You can look at it from the other side too, maybe Americans are putting too much weight on the SSN. I could practically post my Spanish ID number next to my name online and nothing would probably happen. As a matter of fact, a stupid regional government agency posted it next to my name in 2011 and it's been up ever since.

If you properly protect your security number, which requires some monthly commitment (such as $15 lifelock, or freecreditreport $5 per month), you can pretty much post your SSN online and really not much will happen. Any time someone uses it, you will get the alert and chance to act (stop the inquiry before it hit hard). It just that most people believe that not making their SSN public is enough for it to be safe.

The CEO of Lifelock posted his SSN in several ad campaigns to tout the effectiveness of Lifelock. And, surprise, his identity was "stolen" 13 times[0].

[0] http://www.wired.com/2010/05/lifelock-identity-theft/

Re: IRS says thieves stole tax info from 100,000

#79

Something is wrong with the wording here. Thieves stole the tax info of 100,000 but they stole it from the IRS. Make no mistake: IRS needs to be held responsible for this. It is their fault.

So when the victim is someone you don't like, it's somehow their fault?? The fault should be with the person/people that stole the tax information, not the IRS. Blaming the IRS would be like blaming a home owner for not installing a good enough security system when they get robbed instead of the criminals.

Perhaps, but what I can blame them for is for having very poor monitoring (50% failure rate and nobody noticed??) and poor security, culminating in this data breach.

People need to be held accountable for the security of their systems when they are storing personally identifiable information on customers or the public at large.

Edit: Perhaps they shouldn't be blamed when someone leverages a zero-day to break in, but if this is due to their failure to patch their systems, IMO their 100% liable for everything that follows.

Re: IRS says thieves stole tax info from 100,000

#80
post #28

Earlier quoted context omitted.

Someone fraudulently used my social security number. It is such a sick and terrible feeling knowing that your number is "out there" and can be used by anyone for a whole host of things. It feels horrible and really, really violating.

And worse, there's no way to rotate it that I know of, so it's like having your password leak and being unable to change it. It's out there forever.

Your master password leak. Using the same for everything!
Post reply on HN