IRS says thieves stole tax info from 100,000

Thieves hacked into an Internal Revenue Service online service and gained access to information from more than 100,000 taxpayer accounts, the agency said Tuesday.

The criminals used personal data obtained from other sources, including Social Security numbers, street addresses and dates of birth, to get into the IRS "Get Transcript" service. The service has been temporarily shut down.

The thieves gained access to tax returns and other tax information on file with the IRS. The IRS' main computer system that handles tax filings wasn't compromised.

The IRS said in a statement that the hack occurred from February through mid-May. The IRS first detected unusual activity last week.

The Get Transcript application allows users to view their tax account transactions, line-by-line tax return information or wage and income reported to the IRS for a specific tax year. It was used to securely retrieve approximately 23 million taxpayer transcripts last year, the IRS said.

The information the hackers used to get in was probably previously stolen by other hackers who then sold it on the open market, said Rob Roy, chief technology officer of HP Enterprise Security Products.

"The matter is under review by the Treasury Inspector General for Tax Administration as well as the IRS' Criminal Investigation unit, and the 'Get Transcript' application has been shut down temporarily," the IRS said. "As always, the IRS takes the security of taxpayer data extremely seriously, and we are working aggressively to protect affected taxpayers and continue to strengthen our protocol."

Hackers made about 200,000 attempts at getting into taxpayer accounts with personal data. The IRS is notifying everyone who appeared to have personal information stolen and providing credit monitoring for the roughly 100,000 people whose accounts were successfully accessed.

"The IRS historically has been very secure, it has to be by virtue of the data it collects. But it just goes to show that even the most secure system can be attacked," said Larry Ponemon of the Ponemon Institute, a data security research group.

Contributing: Elizabeth Weise