The IRS announced late Thursday night that it has temporarily suspended a $7.25 million contract with Equifax to help verify taxpayers’ identities when creating accounts on the agency’s website, citing “new information available today.”
That “new information” presumably concerned the Equifax webpage which was recently discovered to be redirecting users to download adware. Yesterday, the company took the page down, but denied their systems had been (additionally) compromised, blaming the issue on “a third-party vendor that Equifax uses to collect website performance data.”
The contract suspension will prevent taxpayers from creating new accounts through the IRS’s “Secure Access” program that provides access to transcripts and records. People who have already set up Secure Access accounts will not be affected, but now others can only order tax court transcripts through the mail.
Last week, members of the Senate Banking Committee urged IRS Commissioner John Koskinen to kill the contract in a letter stating that “we have no assurances that our constituents’ personal information is safe in their hands”—a reference the company’s vast array of screw ups that led to one of the worst data breaches in history, compromising the personal information of about 145.5 million people, or about half of US taxpayers.
Koskinen then pushed back, telling senators that doing so would prevent thousands of hurricane victims from accessing tax information.
The IRS awarded the contract to another company in July, but Equifax filed a petition to the Government Accounting Office (GAO). Equifax had a previous contract with the IRS that expired on September 30th, in the midst of the data breach fallout. Since the GAO had not yet made a decision on the petition, the IRS opted to award a short-term contract to Equifax, citing a belief that no other vendors could provided the ID verification that the IRS needed.
“The IRS emphasized that there is still no indication of any compromise of the limited IRS data shared under the contract,” IRS spokesman Matthew Leas told Politico in a statement. “The contract suspension is being taken as a precautionary step as the IRS continues its review.”
We have reached out to Equifax for comment and will update this story if and when they respond.
Update 12:10 pm: An Equifax spokesperson sent Gizmodo the following comment:
Yesterday, the IRS notified us that they have issued a Stop-Work Order under our Transaction Support for Identity Management contract. We remain confident that we are the best party to perform the services required in this contract. We are engaging IRS officials to review the facts and clarify available options.