IRS puts Equifax contract on hold during security review

The U.S. Internal Revenue Service has temporarily suspended a contract worth more than $7 million US it recently awarded to Equifax Inc following a security issue with the beleaguered credit reporting agency's website on Thursday.

Equifax, which disclosed last month that cyber criminals breached its systems between mid-May and late July and made off with sensitive data on 145.5 million people in the United States and about 8,000 in Canada, said on Thursday it shut down one of its website pages after discovering that a third-party vendor was running malicious code on the page.

• Equifax takes web page offline after reports of new cyberattack

"The IRS notified us that they have issued a stop-work order under our Transaction Support for Identity Management contract," an Equifax spokesperson said on Friday.

"We remain confident that we are the best party to perform the services required in this contract," the spokesperson said. "We are engaging IRS officials to review the facts and clarify available options."

The IRS is the first organization to say publicly that it is suspending a contract with Equifax since the credit reporting agency's security problems came to light.

Atlanta-based Equifax said its systems were not compromised by the incident on Thursday, which involved bogus pop-up windows on the web page that could trick visitors into installing software that automatically displays advertising material.

• We've got to change this industry, before more consumers get hurt,' senators tell former Equifax CEO
• Equifax's former CEO faces grilling over handling of data breach

Still, the IRS said it decided to temporarily suspended its short-term contract with Equifax for identity-proofing services.

"During this suspension, the IRS will continue its review of Equifax systems and security," the agency said in a statement. There was no indication that any of the IRS data shared with Equifax under the contract had been compromised, it added.

The move means that the IRS will temporarily be unable to create new accounts for taxpayers using its Secure Access portal, which supports applications including online accounts and transcripts. Users who already had Secure Access accounts will not be affected, the IRS said.

IRS granted the $7.25 million contract to Equifax on Sept. 29, weeks after Equifax disclosed the massive data hack that drew scathing criticism from several lawmakers.

"From its initial announcement, the timing and nature of this IRS-Equifax contract raised some serious red flags ... we are pleased to see the IRS suspend its contract with Equifax," Republican Representatives Greg Walden and Robert Latta said in a joint statement on Friday.

"Our focus now remains on protecting consumers and getting answers for the 145 million Americans impacted by this massive breach," they said.

Government contracts in areas such as healthcare, law enforcement, social services, and tax and revenue, are major sources of revenue for Equifax.

In 2016, government services made up 5 percent of Equifax's overall $3.1 billion in revenue, accounting for 10 percent of its workforce solutions revenues, 3 percent of its U.S. information solutions revenues, and 7 percent of its international revenues, according to a regulatory financial filing.