Taxpayers could have been compromised from FAFSA IRS Data Retrieval Tool. Here’s what to do…

From the New York Times – “Up to 100,000 Taxpayers Compromised in FAFSA Tool Breach, I.R.S. Says”

“The Internal Revenue Service said on Thursday that the personal data of as many as 100,000 taxpayers could have been compromised through a scheme in which hackers posed as students using an online tool to apply for financial aid.

The breach may be the most extensive since 2015, when thieves gained access to the tax returns of over 300,000 people by using stolen data and filed fraudulent returns to get refunds.

The possibility of an attack became known in early March after the IRS shut down its Data Retrieval Tool, which families used to import tax information to FAFSA, the Free Application for Federal Student Aid, on the Education Department’s website. The shutdown, at the height of financial aid application season, caused outrage among parents and students trying to fill out the complicated FAFSA forms.”

Read the rest of the NYT article here.


If you manually entered financial information on your FAFSA instead of using the DRT to import data from the IRS, you should be unaffected by the breach.

According to the article, “…the agency believes that fewer than 8,000 fraudulent returns were filed and processed, resulting in refunds issued.” However, if you are one of the many Utahans who filed the FAFSA early this year due to the recent change over to “prior-prior year” tax information and used the IRS Data Retrieval Tool to import your tax information, it is wise to ensure that your personal information and identity remain safe and secure. Here are a few things you can do:

  1. Place an “initial fraud alert” on bank accounts, credit cards, memberships, etc. What is an initial fraud alert? 
  2. Obtain your credit report and review it. Check carefully for inaccuracies, misinformation, fraudulent charges, etc.
    1. You are entitled to a free annual credit report from the three main credit bureaus. See how to get your free credit reports here.
  3. Review the entire FTC guide on theft of personal information and identity here.

If you haven’t filed your FAFSA yet and need help figuring out how to get your financial aid application filed without the IRS data Retrieval Tool, see “FAFSA: How to get by without the IRS Data Retrieval Tool.