Business

IRS Hires Company That Oversaw Massive Data Breach

No featured image available

The Internal Revenue Service tapped an Equifax subsidiary for taxpayer verification services months after the parent company revealed a data that affected more than 145 million people.

The IRS awarded a $7.25 million contract for “data services … to verify taxpayer identity and to assist in ongoing identity verification and validations needs of the [IRS],” according to a the contract award notification posted Sept. 30.

Equifax Information Services LLC, a subsidiary of Equifax Inc, won the contract as a sole source, meaning that the government did not expect to find the services it needed from any other source and awarded the contract without making the company compete for it.

“In the wake of one of the most massive data breaches in a decade, it’s irresponsible for the IRS to turn over millions in taxpayer dollars to a company that has yet to offer a succinct answer on how at least 145 million Americans had personally identifiable information exposed,” Utah Republican Senator Orrin Hatch, who chairs the Senate Committee on Finance, told Politico.

Oregon Democrat Ron Wyden, the ranking Democrat on the Finance Committee, said the Senate “will be looking into why Equifax was the only company to apply for and be rewarded with this,” saying that it’s important to “prevent taxpayer data from being compromised as this arrangement moves forward.”

The IRS insisted in a statement to politico that Equifax was the only company able to provide the services required.

“Following an internal review and an on-site visit with Equifax, the IRS believes the service Equifax provided does not pose a risk to IRS data or systems,” the statement reads. “At this time, we have seen no indications of tax fraud related to the Equifax breach, but we will continue to closely monitor the situation.”

The company holds millions of dollars in contracts with various agencies and departments in the federal government, including the Office of Personnel Management, according to federal data.

The hack on Equifax went on for around two months before the company noticed the breach July 29, and the company has admitted it was slow to correct a software issue exploited by the hackers.

The CEO leading Equifax at the time, Richard Smith, resigned last week without a severance package, and took responsibility for the criminal hack during testimony before the House Committee on Energy and Commerce Tuesday.

“The criminal hack happened on my watch,” Smith said. “I am truly and deeply sorry for what happened.”

Follow Thomas Phippen on Twitter

Send tips to [email protected].