The IRS is paying Equifax millions for a login system that has been hacked—twice