Taxpayers sue the IRS over data breach

Two taxpayers have filed a lawsuit against the Internal Revenue Service, alleging that the agency didn’t do enough to protect their personal information from hackers.

The plaintiffs, Becky Welborn and Wendy Windrich, are seeking class-action status for the lawsuit.

The IRS in May announced that hackers had accessed old tax returns through the agency’s Get Transcript system, using the records to claim millions of dollars in fake returns.

Original agency estimates pegged the breach at around 100,000 records, but the IRS in August acknowledged that the thieves may have made away with as many as 220,000 additional records.

The plaintiffs claim that the illegal access of records by the hackers “would have been prevented, had the IRS fixed the known security deficits in its data storage system.”

Citing recommendations made to the agency by the Treasury Inspector General of Tax Administration, the suit alleges that the IRS knew its systems were vulnerable to attack but "deliberately and intentionally decided not to implement the security measures needed to prevent the data breach."

The suit does not specify the amount of damages sought.

The IRS is offering free credit monitoring to taxpayers whose information was compromised in the breach. The agency is also contacting taxpayers whose accounts identity thieves targeted but failed to access.

This seems to be a case of “too little, too late” for lawmakers and taxpayers. The agency is already under fire from legislators for its original estimate of the size of the breach.

"Taxpayers deserve to know that the IRS is taking every possible step to safeguard their personal information," Rep. Peter Roskam (R-Ill.) said. "[The] revelation that the IRS didn't fully understand this security breach for months is not confidence-inspiring."

Roskam is the chairman of a House Ways and Means subcommittee that oversees the IRS.