IRS web site hit with major data breach

A web site which processes tax forms for nonprofit groups for the Internal Revenue Service(IRS) had a major data breach, it has been announced. Operated by the Urban Institute’s National Center for Charitable Statistics, or NCCS. The group announced  it had recently discovered that an unauthorized party or parties gained access to the Form 990 Online and e-Postcard filing systems for nonprofit organizations.

Security Alert posted on its site says, “… all users of the e-Postcard system were notified that unauthorized parties gained access to the system and to usernames and passwords. If you registered on the site prior to January 7, 2015 you will be required to change your password if you have not already done so. Please go here for details, answers to Frequently Asked Questions and more information.”

Stuart Kantor, a spokesman for the Urban Institute, emailed Accounting Today on Monday, and wrote,  “TIGTA (Treasury Inspector General for Tax Administration) opened a criminal investigation into this attack. Urban was considered a victim of a crime. We are not privy to the TIGTA investigation, so we do not know its status. The incident did not result in any material downtime or interruption of use of the e-Postcard or Form 990 Online systems.”

The IRS’s Criminal Investigation division announced the creation of a cybercrime unit to deal with data breaches and the growing prevalence of identity theft-related tax fraud

“We are creating a cybercrimes unit within CI to really focus on some large-scale cybercrime-related cases, specifically focused on identity theft and the impact on tax administration,” said Richard Weber, chief of IRS Criminal Investigation, in a conference call with reporters today.

The Urban Institute said last month that an intruder or intruders retrieved email addresses, usernames, passwords, first and last names, IP addresses, phone numbers, addresses and names of nonprofits. The incident affects all users who have filed with the online versions of Forms 990, 990-EZ, and 990-N (e-Postcard). In addition, it affects users of Form 8868 extensions and filings for charitable organizations in Hawaii, Michigan, and New York.

Jeffrey Newman represents whistleblowers