Intuit Notice of Unauthorized Access to Tax Returns [pdf]

https://ago.vermont.gov/wp-content/uploads/2019/02/2019-02-22-Intuit-Notice-of-Data-Breach-to-Consumers.pdf

by robteix • 7 years ago

82 45 7 years ago

ago.vermont.gov

NickM4• 7 years ago

This is exactly why I always used to pay extra for the TurboTax desktop edition (I say "used to" because I ended up ditching TurboTax entirely a couple years ago, but that's another story). It's worth it to me to pay a little extra to reduce the number of entities that have this kind of data stored, and it appears that bet has paid off in this case.

iamsmooney• 7 years ago

Does the desktop edition not utilize the server side logic that might have these accounts? I'm unfamiliar with that product and actually curious.

pwg• 7 years ago

The desktop editions are supposed to run locally, and save data locally [1].

But, one quirk many may not be aware of, even with 'desktop' versions, is if one e-files, the data follows this path:

Desktop -> Intuit (or other software) servers -> IRS

So to avoid a copy of one's tax data being stored on the servers of the software prep. company, one has to print and file via. paper forms.

[1] I realize this does not mean it is not silently uploading the data in the background somewhere to their servers anyway, but the 'web' version is guaranteed to be storing the data on their servers. But I do hope with the number of users using these packages that if this were to happen, someone would notice and sound the alarm.

tacostakohashi2• 7 years ago

What did you replace it with?

I have used it for 5 odd years, but it's really starting to annoy me now. I'm seriously considering trying to find a professional that can handle everything for, say $500/year.

technofiend• 7 years ago

Don't know about Nick but I switched to taxcut after the turbotax C-Dilla kerfuffle. No complaints so far.

Rebelgecko2• 7 years ago

Because I'm paranoid, I usually use Turbotax then do a sanity check by filling the paperwork out by hand. My return is probably slightly more complicated than the average one since 90% of people don't even itemize, but I can still do everything in an afternoon. Unless you have a particularly gnarly tax situation (own a business, exercising stock options, etc) it may be doable to take care of it yourself and save $500. Even if that $500 is a write-off :)

NickM4• 7 years ago

I started using Free File Fillable Forms. It's a refreshingly simple site run by the IRS that lets you fill out all the standard tax return forms in your browser and file them directly. It helps with a few small things, like doing basic math for you e.g. when a particular row is supposed to contain the sum of several other rows, but that's pretty much it. At the end of the filing season, they delete all accounts and data contained on the site, so I mean technically somebody could still hack them I suppose, but at least the attack window is much smaller than in the case of something like TurboTax where they store all your data forever.

The first time around, it's a little bit of a pain to figure out what forms you need to attach and such, but it's really not that hard if you read the instructions for the forms and just follow the directions. If you're doing something complex like running a business and dealing with depreciable property or calculating AMT, it gets a little hairy, but even then I've generally been able to figure things out by just reading through the free publications that the IRS puts up on the web. I also like the sense of deeper understanding that I get from seeing how everything is being calculated, instead of just answering a bunch of questions and then having an algorithm spit out a number for my refund.

alehul• 7 years ago

Why was this recently uploaded to vermont.gov? Wouldn't it be Intuit's responsibility to inform its own users?

Confused whether this is just precautionary and given out to governments each tax season, or if something has occurred. The "Insert Date" makes it appear like the former.

Edit: According to another comment linking to "scmagazine," this is not precautionary!

wonjohnchoi• 7 years ago

The document says that the accounts may have been accessed using id/password combinations obtained from other sources. But doesn't TurboTax have two-factor authentication? If so, how is this possible? If not, what would an extremely important service like TurboTax not have two factor authentication?

crisnoble• 7 years ago

Two factor auth is not required for turbotax.

lozenge• 7 years ago

Because it decreases conversion, and because people only use it one month of the year, and because people will desperately call up about needing to log in to file but they changed their phone number yada yada.

Bhilai• 7 years ago

FWIW, the reports are saying these accounts were compromised due to credential stuffing attacks. While, Intuit can do something about credential stuffing by being proactive and hooking into haveibeenpwned etc. but they were not "breached" in an intrusion sense.

[edit]: Here is a source with more info - https://www.scmagazine.com/home/security-news/intuit-the-com...

MarkMc3• 7 years ago

I think you are letting TurboTax off too lightly. Many banks and the UK tax office make their login credentials unique by having a username with random characters, or requiring an account number on login.

nathantotten3• 7 years ago

That is not the solution. Usernames are not passwords. If they were, why have them at all? Generate a random unique password for your user and don’t have a username at all. As the parent mentioned using haveibeenpwnd or similar service is a much more user friendly and secure approach.

dontbenebby• 7 years ago

I'm surprised they don't do multifactor setup as part of the onboarding process. They offer full blown TOTP[1] but even if it's just SMS based it'd do a lot to mitigate these credential stuffing attacks.

[1] https://ttlc.intuit.com/questions/2902682-what-is-two-step-v...

newman314• 7 years ago

Side note: TurboTax's updater still requires TLS 1.0. facepalm

apo• 7 years ago

This is one of the reasons I will never use a tax preparation product online. Nor will I file online through the IRS's "secure" system. Even the downloadables are open to shenanigans behind the scenes, so it's not the best option either.

At some point, it's possible that one or more IRS databases themselves will be breached. This may (?) cause a re-evaluation of the risks the US government is subjecting its citizens to by collecting and storing such large volumes of financial data.

pavlov2• 7 years ago

Just make everyone's tax returns public. That's what Norway, Sweden and Finland do. Society hasn't collapsed when people know how much money their neighbor makes.

aidenn02• 7 years ago

In the US, lottery winners are advised to remain private because of the significant increase in crime targeting public lottery winners; it's certainly not society collapsing when rich people get robbed, but I'm wondering if criminals in the Scandinavian countries use the tax returns for picking targets?

ryandrake• 7 years ago

I don’t get the motivation behind keeping tax returns secret. It’s like your phone number: I wouldn’t post it to Reddit, but if someone can find it somewhere it’s no big deal to me. I don’t understand the threat model, besides the edge cases others mentioned like lottery winners.

basch• 7 years ago

So you print it, send it in the mail, and then the IRS receives it and OCR's it back into the database you dont want the data in?

ams6110• 7 years ago

Yes, but I get some satisfaction in making them go out of their way to do it.

And no way in hell am I giving the information to Intuit first, so that they can mine and sell it (and probably leak it unintentionally as well)

smkellat2• 7 years ago

There is no OCR in play. Real human beings handle code & edit of returns. Real human beings also check for errors at that time, too.

ccnafr• 7 years ago

Even if one account is compromised, they have to send that notification. So I wouldn't be so worried about it. Some credentials stuffing attack gained access to a few accounts protected by a password like 123456. TurboTax has 2FA support.

argd6782• 7 years ago

I have a ticket open with them for a couple of weeks now due to them not supporting MFA with my bank. My bank requires the token code after the password and TurboTax tries to replay the password and token code twice. I feel like a financial institution shouldn’t be tripped up by enterprise secretary that they assuredly have in house too.

jiveturkey• 7 years ago

This is a defect with your bank, not TurboTax. Your bank should be doing oauth, not user/pass.

https://community.intuit.com/questions/1752343

argd6782• 7 years ago

Not really if TT is saying they support it.

Intuit Notice of Unauthorized Access to Tax Returns [pdf]

Related Stories