This wasn't a hack or a bug - open source software built to do the same thing would've been just as vulnerable to this.

Per the article, the attackers had to put "the taxpayer’s Social Security number, date of birth, address and tax filing status" into a form to get access.