14 DAY TRIAL // Hackers managed to steal up to $30 million from the US government by exploiting a tool created so students could apply for loans. To make matters worse, nearly 100,000 people are at risk of identity theft due to the hack.
Hackers managed to breach the IRS's Data Retrieval Tool, which is used by parents to transfer financial information for their kids using the Free Application for Federal Student Aid. The system has been shut down until the IRS can figure out which of the requests were made by legitimate students, and which were made by criminals.
According to a statement made by John Koskinen, IRS Commissioner, the agency delayed refunds from being released to 52,000 taxpayers until they can verify their requests were real. "It was clear that some of that activity was legitimate students, some of it was criminals. So we shut the system down," he said.
CNET reports that the tool which allowed applicants to automatically upload their tax information was used by hackers to pose as 8,000 college students in tax refund requests. Basically, they would start off like any other student, and then use the IRS tool to automatically populate tax information for the student and parents.
The criminals managed to steal $30 million from the IRS, although about 14,000 other fake tax refunds were blocked by the IRS, which means that the final score could have been much different.
A delayed response
Even though the IRS learned of the data breach back in September, they decided to delay shutting down the loan tool because millions of students depended on it. As the situation worsened, the Department of Education and the IRS decided to disable the tool in March, despite the fact that it was a critical time for students looking to apply for loans. Authorities hope to have the system back online until the fall.
"As soon as there was any indication of criminal activity, we would have to take that application down. That occurred, as we monitored, in through the early part of February," Koskiner said.
The IRS has notified 100,000 people that they are at risk of identity theft due to the data breach.