During suspension, IRS says it will review “Equifax systems and security.”

Recently, the Internal Revenue Service awarded a $7.2 million contract to Equifax to allow Equifax to “verify taxpayer identity.” The contract was awarded days after Equifax announced it had exposed the personal data, including Social Security numbers, of about 145 million people.

The tax-collecting agency is now temporarily suspending the contract because of another Equifax snafu. The Equifax site was maliciously manipulated again, this time to deliver fraudulent Adobe Flash updates, which, when clicked, infected visitors’ computers with adware that was detected by just three of 65 antivirus providers. The development means that at least for now, taxpayers cannot open new Secure Access accounts with the IRS. Secure Access allows taxpayers to retrieve various online tax records and provides other “tax account tools” to those who have signed up.

An “alert” on the IRS website says the Secure Access service “is unavailable for new users at this time.” The alert notes that taxpayers who already have an account can “continue the login process.”

The message ends by saying “We apologize for any inconvenience.”

The IRS said it is investigating the security of Equifax’s systems during this suspension, which could be lifted if Equifax gets a clean bill of health. “During this suspension, the IRS will continue its review of Equifax systems and security. The IRS emphasized that there is still no indication of any compromise of the limited IRS data shared under the contract,” Matthew Leas, an IRS spokesperson, said in a statement. “The contract suspension is being taken as a precautionary step as the IRS continues its review.”

IRS Deputy Commissioner for Operations Jeffrey Tribiano told Congress last week that the bureau was obligated, because of federal contracting rules, to award the contract to Equifax because Equifax had objected to losing the contract to another company.

Tribiano last week said that the IRS either had to shutter the Secure Access service or grant Equifax a so-called “bridge contract” to give the Government Accountability Office (GAO) time to investigate Equifax’s protest.

The GAO, however, said that federal contracting rules gave the IRS some flexibility and that it did not need to grant the contract to Equifax. “Congress gave agencies, like IRS, the tools to move forward under appropriate situations. They appear to be electing not to use it,” Chuck Young, a GAO spokesperson, told The Hill last week.

In his testimony before the House Ways and Means Committee, Tribiano said that the Secure Access service was critical to taxpayers “in the hurricane disaster areas.” Secure Access allowed hurricane victims, if they already had enrolled in the program, to access their tax documents online if they lost their documents in the storms.

Via:  arstechnica