The Australian Taxation Office (ATO) revealed that criminals took advantage of a loophole in the government’s digital identity systems to submit more than $550 million in false claims during the past two financial years.
According to a report by ABC, the attackers discovered they could create fake myGov accounts and link them to legitimate taxpayers’ ATO files.
In a previous investigation in December 2022, it was found that the attackers utilized customer identity information stolen from prominent data breaches like Optus and Medibank to carry out their fraudulent activities.
The ATO disclosed that over 15,000 individuals were affected during the two-year period, leading to the cancellation of more than 37,000 business activity statements and individual tax return lodgements, amounting to a total of $557.8 million.
However, it is unclear how much money was actually paid out to the attackers, as some of the false claims were canceled before disbursement.
The data released under Freedom of Information (FoI) pertains to the two years up to February 28, raising the possibility that the total cost of the fraud could be higher for the entire 2022-23 financial year.
The ATO admitted uncertainty about the exact portion of the $557.8 million directly attributable to the myGov loophole.
Jeremy Hirschhorn, the ATO’s second commissioner, stated that the agency is managing an acceptable level of risk. He highlighted that the myGov and ATO settings were designed for easy access for taxpayers while remaining difficult for criminals to breach.