“This Will Cripple the IRS”: What DOGE’s API Plan Means for Hosting Security

Elon Musk’s Department of Government Efficiency (DOGE) is hosting a 30-day hackathon next week in D.C. to build a “mega API” that centralizes access to IRS and taxpayer data.

Tax season is undoubtedly most Americans’ least favorite time of the year, which may explain DOGE’s goal of modernizing outdated systems and improving accessibility.

Sources told Wired the mega API will act as a unified, public-facing platform for sensitive data, such as tax returns and Social Security numbers.

Sam Corcos, a DOGE staffer, reportedly described the project as “one new API to rule them all.”

Corcos and another staffer, Gavin Kliger, are the leaders organizing the hackathon.

Neither organizer has a background in tax systems or federal infrastructure, which is a point a few IRS staffers anonymously raised concerns about.

One source reportedly told Wired that organizing and structuring the IRS data could “take years.”

They added: “These people have no experience, not only in government, but in the IRS or with taxes or anything else.”

Another IRS staffer reportedly said: “This will cripple the IRS and endanger next year’s filing season.”

The IRS processes more than 250 million tax returns annually.

There’s a reason IRS workers are coming forward, and it’s because the numbers tell a story.

In 2024, federal agencies reported 30,659 information security incidents to the Department of Homeland Security’s U.S. Computer Emergency Readiness Team.

APIs, in particular, are apparently becoming the main points of those attacks.

Every endpoint is a potential attack entry point — and when the data includes W-2s and SSNs, there’s zero margin for error.

Additionally, in 2024 alone, 57% of organizations experienced at least one API-related breach, with 73% reporting multiple incidents.

The “mega API” would have to interface with legacy IRS systems.

The IRS currently operates on a dated infrastructure of 334 legacy systems. More than 100 of them are currently “candidates for retirement,” according to findings by the Treasury Department.

“It’s basically an open door controlled by Musk for all Americans’ most sensitive information with none of the rules that normally secure that data,” another anonymous IRS worker told Wired.

The “mega API” may require middleware, connectors, and translation layers, with each requiring its own hosting environment.

And, of course, more to secure.