Incident
incident:irs_get_transcript_breach
Also: Get Transcript breach, IRS breach
Unauthorized access to taxpayer transcripts through the IRS Get Transcript service, including hundreds of thousands of records.
Unauthorized access to taxpayer transcripts through the IRS Get Transcript service, including hundreds of thousands of records.
“there had been a breach and 100,000 tax records were stolen”
“the IRS is saying it’s twice that; 724,000 people got their tax returns stolen”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Get Transcript | Explicit | 26 |
| outgoing | INITIAL_ACCESS_VIA | Get Transcript | Explicit | 26 |
| outgoing | INVOLVES | Instant knowledge-based authentication | Explicit | 26 |
| outgoing | INVOLVES | Stolen identity tax refund fraud | Explicit | 26 |
| outgoing | INVOLVES | Money mule | Explicit | 26 |
| outgoing | INVOLVES | Internal Revenue Service | Explicit | 26 |
| outgoing | DISCOVERED_BY | Internal Revenue Service | Explicit | 26 |
| outgoing | RELATED_TO | Anthem breach | Uncertain | 26 |
| outgoing | ATTRIBUTED_TO | Russia | Uncertain | 26 |
IRS Get Transcript breach INVOLVES Get Transcript
The IRS breach involved attackers using the Get Transcript feature to obtain taxpayer records.
Explicit Confidence 99% · Jack Rhysider EP 26 Details
“The thieves successfully used the Get Transcript feature of the irs.gov website to obtain the tax records of 100,000 people.”
IRS Get Transcript breach INITIAL_ACCESS_VIA Get Transcript
The attackers initially accessed taxpayer information by navigating through the Get Transcript authentication process.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“They simply found a way to navigate through the authentication system”
IRS Get Transcript breach INVOLVES Instant knowledge-based authentication
Attackers defeated the IRS's instant KBA by using personal information obtained from other breaches.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“probably by using some personal information they obtained from other breaches”
IRS Get Transcript breach INVOLVES Stolen identity tax refund fraud
The breach was connected to fraudulent tax returns filed using stolen taxpayer identities.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“only 13,000 possibly fraudulent returns were filed for tax year 2014”
IRS Get Transcript breach INVOLVES Money mule
The fraud operation involved networks of money mules used to receive and transfer stolen tax refunds.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“Then they had to set up a whole network of money mules”
IRS Get Transcript breach INVOLVES Internal Revenue Service
The incident concerned unauthorized access to taxpayer records held by the IRS.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“The unauthorized attempts to access information using the Get Transcript application”
IRS Get Transcript breach DISCOVERED_BY Internal Revenue Service
The IRS security center discovered the suspicious activity and later identified the unauthorized access.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“our cyber-security team noticed unusual activity on the Get Transcript application”
IRS Get Transcript breach RELATED_TO Anthem breach
Jack suggests that information stolen in the Anthem breach may have enabled the Get Transcript fraud, but he does not establish this as certain.
Uncertain Confidence 82% · Jack Rhysider EP 26 Details
“This would probably be enough to pass the KBA and do the Get Transcript.”
IRS Get Transcript breach ATTRIBUTED_TO Russia
News reports indicated that the identity thieves may have been in Russia; this attribution was explicitly presented as uncertain and incomplete.
Uncertain Confidence 91% · Jack Rhysider EP 26 Details
“News reports indicate that the recent IRS identity thieves may have been in Russia.”