and May 2005, approximately 1.2 million computer users in the United States suffered losses caused by phishing, totaling approximately . United States businesses lose an estimated per year as their clients become victims. Phishing is recognized as a fully organized part of the black market. Specializations emerged on a global scale that provided phishing software for payment (thereby outsourcing risk), which were assembled and implemented into phishing campaigns by organized gangs. 2005 In the United Kingdom losses from web banking fraud—mostly from phishing—almost doubled to in 2005, from in 2004, while 1 in 20 computer users claimed to have lost out to phishing in 2005. 2006 Almost half of phishing thefts in 2006 were committed by groups operating through the Russian Business Network based in St. Petersburg. Banks dispute with customers over phishing losses. The stance adopted by the UK banking body APACS is that "customers must also take sensible precautions ... so that they are not vulnerable to the criminal." Similarly, when the first spate of phishing attacks hit the Irish Republic's banking sector in September 2006, the Bank of Ireland initially refused to cover losses suffered by its customers, although losses to the tune of €113,000 were made good. Phishers are targeting the customers of banks and online payment services. Emails, supposedly from the Internal Revenue Service, have been used to glean sensitive data from U.S. taxpayers. While the first such examples were sent indiscriminately in the expectation that some would be received by customers of a given bank or service, recent research has shown that phishers may in principle be able to determine which banks potential victims use, and target bogus emails accordingly. Social networking sites are a prime target of phishing, since the personal details in such sites can be used in identity theft; in late 2006 a computer worm took over pages on MySpace and altered links to direct surfers to websites designed to steal login details. 2007 3.6 million adults lost in the 12 months ending in August 2007. Microsoft claims these estimates are grossly exaggerated and puts the annual phishing loss in the US at . Attackers who broke into TD Ameritrade's database and took 6.3 million email addresses (though they were not able to obtain social security numbers, account numbers, names, addresses, dates of birth, phone numbers and trading activity) also wanted the account usernames and passwords, so they launched a follow-up