The US' Internal Revenue Service (IRS) has been forced to suspend its Get Transcript online data service after hackers stole data from 104,000 people.
The agency said a sophisticated hack by experienced criminals allowed them to break into its systems by pretending to be legitimate taxpayers. They used previous stolen data such as Social Security numbers, birthdays and physical addresses to access the network and then managed to infiltrate the database of more than 200,000 tax forms, submitted for purposes including mortgage applications and university aid.
The attack was so sophisticated, the IRS said, the hackers even managed to guess the correct answers to personal identification questions.
The hackers managed to extract records about 104,000 people and used 15,000 of these records to claim tax refunds falsely between February and May.
However, the highly sensitive data, including salary information and details about tax deductions could be used for more malicious operations, such as setting up bank accounts, IRS Commissioner John Koskinen said.
The IRS discovered the hack when it realised abnormal levels of traffic on its site. At first, it thought it was being the victim of a DDoS attack, but it soon came to realise the requests were accessing data on its Get Transcript service.
Koskinen said: "This is just the latest manifestation of people getting enough data to masquerade as a taxpayer.
"We're dealing with criminals with a lot of money and using expensive equipment and hiring a lot of smart people. These guys are very good at data analytics. They have volumes of data available they can match up. The criminals can answer questions better than you can."
