IRS Data on Up to 100,000 Taxpayers Compromised in Breach of College Financial-Aid Tool

Personal information for up to 100,000 taxpayers may have been compromised in a security breach of a critical online tool used to fill out student loan applications, Internal Revenue Service Commissioner John Koskinen said Thursday.

The IRS is beginning to notify people potentially affected by the breach, Mr. Koskinen said during a Senate Finance Committee hearing.

The digital retrieval tool, which allows tax returns to be imported to the Free Application for Federal Student Aid form, was taken offline in March after identity thieves used it to gather information to file fake returns seeking refunds. About 8,000 fraudulent refunds were issued, costing $30 million, Mr. Koskinen said. IRS filters stopped 52,000 returns and prevented 14,000 illegal refund claims from being sent.

The IRS knew in September there was a potential risk in the online tool and began talking to the Education Department about it in October, he said.

"I told (the Education Department) as soon as there was any indication of criminal activity, we would have to shut that system down," Mr. Koskinen said. "We're trying to anticipate where the criminals will attack next."

Mr. Koskinen said the government was reluctant to make a quick decision last year to terminate the popular tool.

"To shut it down without a clear indication of criminals actually using it seemed to us that it was going to unnecessarily disadvantage millions of people who used it," he told reporters after the hearing.

Some of the tax returns that were flagged as possibly affected in the breach were legitimate, Mr. Koskinen said. They included taxpayers who paid money with their returns -- not the way refund fraud works -- and taxpayers who filed their returns before using the Education Department's tool.

"We caught it early enough that there's not a significant volume of money out the door," he said.

The tool won't be available for the rest of this application cycle and that has prompted statements of concerns from lawmakers worried the outage could discourage low-income students from applying for financial aid or participating in income-driven loan-repayment plans, for which the IRS tool is also used.

Over the past few years the IRS has reviewed the more than 200 ways it provides tax data to individuals and companies, Mr. Koskinen said. The agency last year temporarily shut down a system used to provide information to mortgage lenders.

A criminal investigation into the breach is ongoing. On Thursday, Senate Finance Committee Chairman Orrin Hatch (R., Utah) said the IRS last week gave committee staff a confidential briefing on the investigation and the agency's response to the breach.

Students were able to apply for federal financial aid for the 2017-18 academic year starting in October, rather than around Jan. 1, for the first time last year. As a result, more high school seniors completed their applications earlier this academic year than in prior years. But lawmakers have expressed concern that low-income students with parents who aren't savvy about financial aid or those without access to guidance counselors are less likely to finish the forms.

The inaccessibility of the tool, which has been in place for eight years, doesn't mean students can't file a Fafsa form, just that they must enter their family's financial information by hand. By entering information by hand, students are much more likely to be asked to verify that information with documents, which may dissuade some students from applying for aid and attending college.

The tool is expected to be available again on Oct. 1 for the 2018-19 academic year.