Its use of the singular is technically wrong. This is a downstream effect of the thousands of data breaches that have occurred in the past few years. Anything that provides a name and social security number could do it.
Actually I'm pretty sure it's referring correctly to a singular probe. And unless you know something I don't, it's entirely plausible it's the result of a single data breach (e.g. the recent one at Anthem).
The article indicated that the fraudulent returns seemed to be based on last year's returns for the individuals in question, so it sounds like a lot more than name and SSN were involved here.