The Treasury Inspector General for Tax Administration, known as TIGTA, has rated the IRS’s information security program ineffective for the second year in a row. In a report dated September 15, 2026, the watchdog said six of seven sampled IRS systems still carried critical vulnerabilities that were not fixed within the 30 days federal rules require.
Affiliate links — we may earn a commission.
The finding comes from TIGTA’s yearly evaluation under the Federal Information Security Modernization Act, the law that makes agencies prove their cybersecurity works. The report warns that without fixes, “taxpayer data could be vulnerable to inappropriate and undetected use, modification, or disclosure.” It does not describe a specific theft of taxpayer records.
Ratings by function
The evaluation scores the IRS on six functions from the National Institute of Standards and Technology’s cybersecurity framework. According to FedScoop, which linked to the report, the IRS was rated effective on governing its program, responding to incidents and recovering from them. It fell below an acceptable maturity level on identifying risks, protecting systems and data, and detecting threats.
Six of seven systems, 841 accounts
The patching finding is the one in the headline. TIGTA sampled seven systems and found that six had critical vulnerabilities left unfixed past the 30-day window. The IRS also could not provide an inventory of its critical software.
A second problem involves privileged service accounts, the high-access accounts that applications and administrators use. TIGTA found 841 of them across 313 systems sitting outside the IRS’s privileged account management system, so nobody is tracking how they are used the way a managed account would be.
Anyone who files a tax return, including the many retirees who still file because of pension or investment income, has a Social Security number sitting in these systems. The practical question is what a taxpayer can do on their own end, since a watchdog report cannot be acted on by a person at a kitchen table.
TIGTA’s warning is about what could happen, not about a documented theft. Data brokers and people-search sites keep their own profiles of the same people, outside the IRS’s systems entirely, and Incogni sends removal requests to those brokers for you, asking them to remove your personal information and re-sending the requests. Less personal data on broker lists can mean fewer scam calls, texts and emails.
The Journal of Accountancy reported that TIGTA also gave the IRS credit. Seventy-two percent of the cybersecurity metrics reviewed reached advanced maturity levels, and TIGTA cited gains in multifactor authentication, audit log collection and configuration compliance. The overall rating still came out ineffective, the same as in fiscal 2025.
The encryption date that moved
Encrypting stored data across the IRS’s critical systems is still unfinished. The original goal was the end of fiscal 2024, and the IRS has moved the target to fiscal 2027. Endpoint detection and response software, which watches individual computers for attacks, is missing from 29 percent of the seven high-value systems TIGTA reviewed. Only about a third of the required security and privacy control assessments were completed.
The evaluation also faulted the IRS for weaknesses in spotting unauthorized hardware and software on its network, and for a monitoring strategy that was not updated after an internal reorganization. FedScoop reported that the reorganization stalled an agencywide continuous monitoring strategy.
What the IRS told TIGTA
The IRS disputed two of TIGTA’s ratings on information security continuous monitoring, arguing it deserved higher marks for its monitoring strategy and its ongoing control assessments. TIGTA did not budge. “The IRS was unable to maintain an organization-wide strategy,” the report said, according to the Journal of Accountancy.
In a letter to TIGTA, IRS Chief Information Officer Kaschit Pandya wrote that the agency “will continue enhancing its governance documentation and program artifacts to improve traceability and transparency.” The IRS said it appreciates TIGTA’s feedback and remains committed to strengthening its program, FedScoop reported. The Journal of Accountancy noted that the report made no formal recommendations, because these evaluations measure performance against set metrics.
The timing matters for readers because this is not a one-off. TIGTA says its reviews found the same overall result the year before, so the vulnerabilities, accounts and encryption gaps described here are carried forward from an earlier year’s findings, not new.
Shielding a tax account with an IP PIN
The free route is the IRS itself. Its identity theft resource page explains how to prevent and report tax-related identity theft. The strongest single step it offers is an Identity Protection PIN, a six-digit number that helps keep someone else from filing a return with a person’s Social Security number or taxpayer ID. Only the taxpayer and the IRS know it.
Anyone with a Social Security number who can verify their identity can get one. Taxpayers who already have an IRS online account can get the number from that account’s IP PIN section, which is the quickest route. People without an online account can use Form 15227 if their adjusted gross income on the last return was below $84,000 for an individual or $168,000 for a married couple filing jointly, and the IRS calls to verify identity before mailing the PIN. A new number is issued each year, and it is generally viewable online from mid-January to mid-November.
The IRS states plainly that it will never ask for an IP PIN. A caller, email or text that asks for one is a scam, and the number should be shared only with a tax professional at the time of filing.
Personal details outside the IRS’s systems
The TIGTA report covers IRS systems, which no taxpayer can change. Broker profiles are different, because a person can ask for them to come down. Incogni asks data brokers and people-search sites to remove your personal information, sends the removal requests on your behalf and keeps re-sending them. You can see the status of each request in your account.
Send Incogni after the broker profiles that carry your name and address →
This article was produced with AI assistance and reviewed by The Financial Wire’s editorial team.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
