Security Experts:

Connect with us

Hi, what are you looking for?


Fraud & Identity Theft

Identity Thieves Use Stolen SSNs in IRS Attack

The U.S. Internal Revenue Service (IRS) revealed on Tuesday that identity thieves abused its Electronic Filing PIN application in an attempt to generate PINs for stolen social security numbers.

The U.S. Internal Revenue Service (IRS) revealed on Tuesday that identity thieves abused its Electronic Filing PIN application in an attempt to generate PINs for stolen social security numbers.

The E-File PIN application hosted on allows taxpayers to generate a PIN that they can use to file tax returns online. When obtaining a PIN, users must provide their name, date of birth, SSNs and mailing address.

According to the agency, identity thieves obtained this information from other sources and used an automated bot to generate PINs for the E-File service. The IRS detected unauthorized attempts using roughly 464,000 unique SSNs, 101,000 of which were successful in generating PINs.

Impacted individuals will be notified via mail and their accounts have been secured against tax-related identity theft. The agency said its systems were not breached and no taxpayer data was compromised.

“IRS cybersecurity experts are currently assessing the situation, and the IRS is working closely with other agencies and the Treasury Inspector General for Tax Administration. The IRS also is sharing information with its Security Summit state and industry partners,” the IRS said in a statement.

The agency pointed out that the attack took place in January and it’s not related to the outage suffered by its tax processing systems last week.

This was not the first time cyber thieves used information obtained from other sources to abuse the IRS’s online services. In May 2015, the agency informed more than 100,000 taxpayers that their accounts on the Get Transcript system were accessed by unauthorized parties using stolen information. Investigators later determined that the total number of accounts breached in the attack exceeded 300,000.

Related: DoJ Investigating Leak of FBI, DHS Employee Details

Related: DHS’s Einstein Security System Has Limited Capabilities

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...


Pig Butchering, also known as Sha Zhu Pan and CryptoRom, is an ugly name for an ugly scam.


A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.


Spanish and US authorities have dismantled a cybercrime ring that defrauded victims of more than $5.3 million.


Australian authorities sentence Sydney man for using leaked data stolen from wireless carrier Optus to conduct SMS scams.

Application Security

After skipping last month, Adobe returned to its scheduled Patch Tuesday cadence with the release of fixes for at least 38 vulnerabilities in multiple...