Full Breakdown
Surge in Cyber Attacks on myIR Accounts: Inland Revenue Responds
4/2/2026, 9:33:03 AM
Overview of the Cyber Incident
Inland Revenue, New Zealand's tax agency, reported a significant increase in cybercriminal activity targeting its myIR accounts. In the past month, the agency recorded over 500,000 malicious logon attempts, resulting in unauthorized access to approximately 300 accounts. Despite these breaches, no financial losses have been reported.
Details of the Breach
The cyber attacks occurred over a two-week period, during which hackers successfully accessed 300 myIR accounts that had not implemented two-step verification (2SV). Inland Revenue emphasized that the introduction of 2SV last year played a crucial role in preventing unauthorized access to the majority of accounts. The agency is currently monitoring an additional 900 accounts where correct passwords were entered, but access was blocked due to the presence of two-factor authentication.
Official Statements & Responses
Inland Revenue stated, “Inland Revenue believes two-step verification... prevented access to most accounts. However, around 300 myIR accounts which did not have 2SV set up were accessed.” The agency is actively reaching out to the 300 affected customers to inform them of the unusual activity detected on their accounts.
Criticism & Opposition
While Inland Revenue has taken steps to enhance security through two-step verification, some critics argue that the agency should have implemented this security measure sooner to protect all users. Concerns have been raised about the adequacy of the agency's cybersecurity protocols and the potential risks posed to users who may not have enabled additional security features.
What's Next
Inland Revenue is expected to continue monitoring the situation closely and may consider further enhancements to its cybersecurity measures to prevent future breaches. The agency's response to this incident will likely inform its future strategies regarding user account security and customer communication.
Verbatim Quotes
- “Inland Revenue believes two-step verification, rolled out last year to give an added layer of protection, prevented access to most accounts.” — Inland Revenue
- “Those 300 accounts have been closed, and we are monitoring up to 900 accounts where a correct password was entered, but two-factor authentication prevented access.” — Inland Revenue
This incident highlights the ongoing challenges faced by organizations in safeguarding user accounts against cyber threats and underscores the importance of implementing robust security measures.
