WASHINGTON—The extent of the IRS data breach continues to get larger, with the agency now saying more than 700,000 Social Security numbers and other sensitive information may have been stolen.
When the breach was first reported last May, the IRS said 100,000 records were compromised. Then, in August, the agency moved the number of potential victims to 334,000.
Hackers used the "Get Transcript" program, which allows people to check their tax history online, to gain access. The IRS began the online program two years ago, allowing taxpayers to request their tax history over the Internet, in addition to the post office. But following a nine-month investigation by the Treasury Inspector General for Tax Administration, the IRS said its online service has put hundreds of thousands of more taxpayers at risk of identity theft.
"The IRS is frankly not doing enough to protect us," Steve Weisman, a senior lecturer at Bentley University and an expert in identity theft, told CBS News. "The very fact that it takes them so many months to even analyze the depth of the problem shows you that there are probably more identity theft that is going on."
The IRS said hackers used personal information gathered from other online sources—like bank accounts—to answer personal identity questions on the "Get Transcript" forms.
One possible culprit is the IRS-approved tax preparers. According to an audit conducted by the non-profit online trust alliance, six out of 13 IRS-approved companies failed at providing adequate security to customers, CBS reported.
"We're often our own worst enemies because there are times that we don't use proper passwords, we don't use proper security," Weisman told the news outlet.
The IRS said they are notifying the hacked taxpayers by mail, as well as offering free identity protection for a year.
In a statement, the agency said it's "committed to protecting taxpayers on multiple fronts against tax-related identity theft... We are moving quickly to help these taxpayers."