In a follow up security audit to determine how many improvements the Internal Revenue Service made to its data security, the Government Accountability Office (GAO) concluded the IRS is “making progress.” Last year, the GAO recommended 70 changes to the tax collecting agency. “Financial and taxpayer data will remain unnecessarily vulnerable to inappropriate and undetected use, modification, or disclosure,” the GAO said. And while the IRS picks away at its vulnerabilities, the threat of tax refund fraud is increasing. In 2014, criminals pilfered $6.5 billion from taxpayers by filing false W-2s with the individuals’ information. This year, the IRS predicts criminals will get away with $21 billion. Remember: The IRS has been taking a little from every paycheck year round. The refunds belong to the taxpayer.

“It goes without saying that if the IRS were a private business, its executives would either be in court or prison,” wrote Investor’s Business Daily. “But the White House can at least make fixing these glaring risks a priority. Until that happens, expect to hear more reports of IRS data breaches.”

Meanwhile, for more than 1,000 days, the IRS has successfully avoided cooperating with investigations looking into its targeting of conservative nonprofits to aid Barack Obama’s re-election. The IRS needs reform in more ways than one.