Data Breach: Tax-Related Information for Taxpayers

A data breach is the intentional or unintentional release or theft of secure information. It can be the improper disposal of personally identifiable information in the trash or a sophisticated cyber-attack on corporate computers by criminals. It can affect companies large or small.

The one common link is the victim, the person whose identity, financial or personal information has been compromised.

Here’s what you should know about data breaches:

Not every data breach results in identity theft, and not every identity theft is tax-related identity theft. 

Tax-related identity theft is when someone uses your Social Security number to file a false tax return claiming a fraudulent refund. Your tax account is most at risk if the data breach involves both your SSN and financial data, such as wages. Data breaches involving just credit card numbers, health records without SSNs or even drivers’ license numbers, while certainly serious, will not affect your tax account.

The IRS stops the vast majority of fraudulent tax returns.  If fraud is suspected, the IRS will contact you via mail with instructions. Or, you may attempt to file electronically and your return is rejected as a duplicate.

If you are a data breach victim, take these steps:

1. Determine what type of Personally Identifiable Information (PII) has been lost or stolen. It is important to know what kind of information has been stolen so you can take the appropriate steps. For example, a stolen credit card number will not affect your IRS tax account.
2. Stay in touch with the company that lost your data. Companies sometimes offer special services, such as credit monitoring services, to assist victims.
3. Follow the Federal Trade Commission recommended steps:
   • File a police report
   • File a complaint with the FTC
   • Notify one of the three majority credit bureaus to place a fraud alert on your credit file
   • Close any accounts opened without your permission
4. If you received IRS correspondence or your e-file tax return was rejected as a duplicate, these additional steps should be taken.

Who should file a Form 14039?

This form should be filed if your Social Security number has been compromised and IRS has informed you that you may be a victim of identity theft tax fraud or your e-file return was rejected as a duplicate.