The Vermont Department of Taxation (USA) has disclosed that taxpayers' personal and financial information was exposed due to a security flaw affecting its online filing site. This flaw was discovered on July 2, 2020. The data affected all Vermont residents who filed their estate tax returns online using the department's website between February 2017 and July 2020.
Verification credentials for electronically filed property transfer tax returns available in public municipal records could be used to access tax return information filed in recent months. In addition, the credentials could be used by hackers to access private information, including the social security number of the property buyer and the last four digits of the property seller's social security number.
According to the Vermont Department of Taxation, when it was notified of the flaw that led to the leak of taxpayer data, it immediately disabled the feature that could have allowed unauthorized “users” to access others’ tax data.
The tax department also said in a statement that it understands that letting users of its site know that their information is secure is very important for tax filing, noting that it understands that there will be concern and frustration from taxpayers. However, the department stressed that the security of personal data is its highest priority, while informing taxpayers about the protection measures they must take is critical.
The department has addressed the bug that prevents municipal records from being used as part of future searches for previously filed property transfer tax returns.
The security alert also states that the department cannot currently determine whether any individual's data was accessed or leaked, and has had no reports of unauthorized access to property transfer returns.
However, although the risk of taxpayer data being accessed over the past three years due to this issue should be low, according to the Vermont Department of Taxation's notice, those who have filed estate tax returns electronically between February 2017 and July 2020 are advised to take certain steps to protect themselves from potential identity.
The list of tips for protecting yourself from fraud includes reviewing your financial activity for the next two years. They are also advised to:
- To check the status of their bank account and credit/debit card for the next 1-2 years and to immediately report any suspicious activity they detect.
- Contact the local police and file an identity theft report if they detect suspicious activity in their financial transactions and activities.
- Place a fraud alert on credit files so that creditors can contact them before opening new accounts if they spot suspicious activity on their credit reports or other account statements.
