ATO claims online systems are ‘secure and resilient’

The ATO has released a statement claiming its systems are secure, resilient and have not been compromised, contrary to recent hacking reports in the media.

The Tax Office issued the statement in response to a number of recent media reports including an article by The Australian which stated that hackers were “harvesting potentially thousands of bogus tax returns as they exploit ongoing security weaknesses in the ATO’s online portal and the commonwealth’s myGov system.”

According to the article published on Sunday night, unsuspecting taxpayers and their accountants had discovered that hackers had infiltrated their myGov accounts, filed fake tax returns and directed the funds to their own bank accounts.

The article also stated that those who came forward with stories of being caught in ATO tax hacking fraud already had two-factor authentication security.

In a statement yesterday, the Tax Office said the safety of taxpayers’ information was of the “utmost importance” and that it would remain vigilant for new and emerging cyber threats.

"The Australian Taxation Office (ATO) is aware of media reporting that the ATO has been ‘hacked’. This is incorrect. The ATO’s systems are secure, resilient and have not been compromised," the Tax Office said.

The ATO said taxpayers should contact the ATO immediately if they see any unusual activity in their account and to keep on top of their security and privacy information.

“If an individual sees unusual activity on their ATO account, it may be related to identity theft. Identity information can be compromised in a variety of ways, including requests for information by malicious actors, phishing emails, large-scale data breaches, and individual device or home network hacking,” the ATO said.

“When the ATO suspects that a taxpayer’s identity may be compromised, the ATO activates stringent security measures to protect the taxpayer…In addition to calling the ATO, if taxpayers think their identity has been compromised and it has impacted their tax affairs, they should also inform their tax agent.”

The ATO said over the past year it had introduced a range of measures to better protect client identity and accounts.

In addition to this, the ATO said it would soon be deploying additional security features in the ATO app to better protect taxpayers and their confidential information, including the ability to receive secure messages from the ATO when key information was changed.

“The ATO continues to encourage individuals to use myID when interacting with the ATO’s online services and to set up the highest identity strength where possible to make it harder for fraudsters to exploit their identities,” the Tax Office said.

“The ATO reminds taxpayers to be wary of scam emails, phone calls and text messages claiming to be from the ATO, particularly at tax time. The ATO may use SMS or email to ask taxpayers to contact us, but will never send an unsolicited message containing a hyperlink to log on to online services.”