IRD sends out emails to wrong people

File photo / Janna Dixon

Inland Revenue is not ruling out the possibility of a cyber-attack after it wrongly sent emails to 47 people yesterday.

The error has prompted the department to shut down all inbound emails while it investigates whether it is the latest Government agency to be hit with a privacy breach.

IRD acting deputy commissioner Mike Hewetson said the emails were mistakenly sent due to a software glitch on one of the department's two external email servers at 1.19pm yesterday.

The software, which screens all inbound and outbound emails for spam and viruses, for some reason altered the 'to' and 'from' fields of 182 emails.

That resulted in 47 people being sent emails which they were not the intended recipient of.

Mr Hewetson said it was unclear whether the emails had contained taxpayer information, but the Privacy Commissioner and the Government's chief information officer were informed of the error immediately.

"We take the privacy and security of information very seriously and we are working to determine the exact cause of the error.

"Currently we are checking the content of the emails to see if anyone has had their privacy breached."

Mr Hewetson said the department was confident the error had not affected sensitive taxpayer information on IRD's core tax database.

He said while the error was thought to have been caused by software corruption, the IRD was also looking into whether it was the result of a cyber-attack.

"While at this stage there is no evidence of any malicious activity, the review that we are doing will examine that, and is intended to assure us that other Inland Revenue systems have not been affected.

"This is a really unique event for us and while we are sure that this is about the corruption of a piece of code in our gateway email system, we do remain open to other possibilities."

The department was contacting affected people to apologise, and has asked for anyone who believed they had incorrectly received email from IRD to get in touch.

The IRD was now holding all inbound and outbound emails at its gateway server until the cause of the problem had been established and experts were satisfied the issue would not happen again.

The department handles about 100,000 emails on a given business day.

It hoped to have the system back up and running by the end of the weekend, but would not do so at the expense of the security of individual information or the integrity of the system as a whole.

Revenue Minister Peter Dunne said he was very disappointed by the error, but the department had responded quickly and well.

"The department is investigating this at the same time as it is working around the clock on getting to the bottom of what went wrong with the software and fixing it," he said.

"The department's primary concern and mine as minister is the integrity of our tax system, and above all, the security of tax payer information."

Mr Dunne said there was never a good time for an error like this to occur, but the fact it happened on a Friday afternoon had allowed the the department to work on fixing it over the weekend.