A massive IRS data breach is much bigger than first realized.
Hackers were able to get sensitive information using the agency’s “Get Transcript” program– which allows people to check their tax history online.
Not even Virginia based tax attorney, Wayne Zell, was protected from hackers who he says stole his identity.
“Somebody was trying to claim a refund using my social security number and I knew something was wrong,” said Zell.
The IRS’s data dump is the latest in a series of disclosures.
In May 2015, the agency reported cyber criminals accessed some 114,000 taxpayer accounts. Three months later, that number grew to 334,000. This month, the IRS says there as many as 724,000 victims.
“The IRS is frankly not doing enough to protect us,” said Steve Weisman, Bentley University, identity theft expert.
The IRS said hackers used personal information gathered from other online sources – like bank accounts – to answer personal identity questions on the “get transcript” forms.
One possible culprit: IRS-approved tax preparers.
One audit found six out of 13 IRS-approved companies failed at providing adequate security to customers.
We’re often our own worst enemies because there are times that we don’t use proper passwords, we don’t use proper security,” said Steve Weisman, Bentley University Senior Lecturer.
The IRS says it is notifying the hacked taxpayers by mail, as well as offering free identity protection for a year.
The online viewing and download feature of “get transcript” has been suspended since may 2015.
The IRS is working to restore that, but this time with enhanced security to protect taxpayers.
The IRS has previously said it believes the hackers are part of a sophisticated crime ring based in Russia.
© 2016 CBS Interactive Inc. All Rights Reserved.