Two taxpayers, Becky Welborn and Wendy Windrich, have recently filed a suit seeking class action status against the Internal Revenue Service in response to a massive data breach that affected 330,000 people.
In the data breach, hackers accessed the IRS' "Get Transcript" feature, which allows taxpayers to download their tax filings from previous years. To do so, the hackers inserted victims' Social Security numbers, dates of birth, tax filing statuses, street addresses and more.
The lawsuit claims that the IRS knew its website was vulnerable to security breaches, but didn't take any actions to address the issues.
The lawsuit explains, "At the time of the data breach of taxpayers' information, the IRS had received — but not acted on — numerous reports that its systems did not have adequate security; it knew its systems had been previously hacked by cyber-criminals; it knew that cyber-criminals were highly motivated to hack the IRS system in order to steal taxpayer information that has significant value in the black market; and it has actual knowledge that cyber-criminals were engaged in ongoing efforts to hack the IRS systems."
The lawsuit also mentions: "What should have been a trustworthy digital service had been compromised and is yet the latest sign that the U.S. Government cannot be relied upon to keep the personal data of its citizens safe."
The suit alleges that the breach could have been avoided if the IRS fixed known security deficits. The suit claims that the IRS "deliberately and intentionally decided not to implement the security measures needed to prevent the subject data breach."
Plaintiff Wendy Windrich never used the "Get Transcript" application on the IRS website, but found that her personal information was used when filing a fraudulent tax return that claimed a refund of $9,300, following the recent IRS data breach. Plaintiff Becky Welborn was informed that her personal data has been used to file a duplicate joint return, and an IRS representative explained to Welborn that her transcript was accessed using the "Get Transcript" feature.
“As custodians of taxpayer information, the IRS has failed in its obligation to protect the personal and sensitive information of hundreds of thousands of taxpayers, their spouses and families,” Richard McCune, a lawyer representing the plaintiffs, said in a statement.
The IRS declined to comment on the lawsuit to Bloomberg News, but in a statement, explained that the agency is notifying taxpayers who may have been impacted by the breach. The IRS is also offering free credit protection for affected taxpayers.