In an official statement issued today, the IRS announced that it has shut down an online service to obtain tax records after determining that "unusual activity had taken place on the application, which indicates that unauthorized third parties had access to some accounts on the transcript application." An initial review of that activity revealed "access was gained to more than 100,000 accounts through the Get Transcript application," according to the IRS statement.

After the IRS disclosed more information, it became clear the user data was not obtained because of a direct hack of government systems. Rather, weak authentication used by the IRS to protect access to taxpayer data is likely at fault. The attackers were able to acquire taxpayer records using stolen personal identifying information, possibly pulled from online financial fraud marketplaces.

The Get Transcript application, a feature of the IRS' site that allows taxpayers to download tax return and tax payment transaction data, was apparently targeted by financial fraudsters between February and mid-May. The service was shut down last week as the IRS investigated the activity, which may have been linked to the fraudulent filing of tax returns and transfer of tax refunds. Attempts were made to access over 200,000 accounts; roughly half failed because of incorrect information inputted during the IRS' authentication process.

The Get Transcript Online feature of IRS.gov allows taxpayers to get "tax account transactions, line-by-line tax return information, or wage and income reported to us for a specific tax year." To obtain a transcript online, all that was needed to start the process was a Social Security number and an active e-mail address. Once the e-mail address was confirmed as legitimate, the system would then ask a number of questions about personal, financial, and tax information—including date of birth, tax filing status, and address—before providing the transcript for download.

This sort of authentication, called knowledge-based authentication, is highly vulnerable to fraud. It's based on information that never changes, and such data is widely available to anyone willing to pay for it from stolen financial information marketplaces. The transcripts that were fraudulently downloaded were likely made accessible due to leaked Social Security numbers and other personal data from any one of the many recent data breaches, including those at health insurers Anthem and CareFirst. In fact, security reporter Brian Krebs reported on the risks inherent in the IRS' transcript request system way back in March. He warned taxpayers to sign up for accounts on IRS.gov if only to prevent someone from creating a fraudulent account for their records first.

Krebs reported on a specific case involving a man who had tried to file taxes online, only to find out that someone had filed using his personal information before him. The attacker then used the victim's information to get a refund direct deposit. "When he tried to get a transcript of the fraudulent return using the 'Get Transcript' function on IRS.gov, he learned that someone had already registered through the IRS’s site using his Social Security number and an unknown e-mail address," Krebs reported. The fraudulent return had been filed through the IRS's own free tax filing site.

In the case outlined by Krebs, the false return was sent to the bank account of a college student who had "answered a Craigslist ad for moneymaking opportunities." She sent much of the money via Western Union to addresses in Nigeria while retaining some for her services. The student claimed she was unaware of anything illegal.

Today's disclosed data breach did not involve the circumvention of any of the IRS' core security systems, an IRS spokesperson noted in the agency's statement.. "The IRS notes this issue does not involve its main computer system that handles tax filing submission; that system remains secure."

However, that information may be of little comfort to the approximately 100,000 taxpayers whose data is now in the hands of the financial fraud marketplace. The same goes for the other 100,000 or so individuals whose SSNs were used in an attempt to access their tax records. The IRS will be "sending a letter to all of the approximately 200,000 taxpayers whose accounts had attempted unauthorized accesses, notifying them that third parties appear to have had access to taxpayer Social Security numbers and additional personal financial information from a non-IRS source before attempting to access the IRS transcript application," the agency said in its statement.

Those whose records were accessed will be offered free credit monitoring "to ensure this information isn’t being used through other financial avenues," the IRS statement noted. Additionally, the affected taxpayers' records will be monitored for fraud for the current and 2016 tax reporting periods. The IRS "is marking the underlying taxpayer accounts on our core processing system to flag for potential identity theft to protect taxpayers going forward—both right now and in 2016," according to the official statement.