The Internal Revenue Service (IRS) is notifying taxpayers impacted by the data breach caused by former IRS contractor Charles Littlejohn, who illegally accessed and distributed private tax information of individual and corporate taxpayers. Court documents reveal that Littlejohn disclosed returns and return information dating back more than 15 years, covering thousands of wealthy individuals, to a news organization. Littlejohn used broad search parameters to evade IRS protocols and save tax returns to personal storage devices, including an iPod. Littlejohn was charged with unauthorized disclosure of tax information and sentenced to five years in prison in January of 2024.
The IRS is taking steps to inform impacted taxpayers of the breach, as required by law. The government has identified at least 152 victims of the breach, whose tax information was published by the media. While the number of letters to be sent out by the IRS has not been disclosed, it is estimated to be in the thousands. The government has proposed providing public notice on the Department of Justice website to notify potential victims of the breach. Under section 7431(e) of the tax code, the Secretary of the Treasury is obligated to notify taxpayers if a person is charged with unauthorized inspection or disclosure of their tax information.
Victims of the breach may be able to sue for damages under section 7431(a) of the tax code. If the accused person is an officer or employee of the United States, the taxpayer may sue the United States in district court. If the accused person is not a US employee, the taxpayer may sue the individual. Littlejohn, being an independent contractor, raises the question of whether he was an employee of the US. Kenneth Griffin, a victim of the breach, has filed a lawsuit against the IRS, claiming the agency failed to safeguard his confidential tax information. The court has allowed Griffin to proceed with his lawsuit against the IRS.
Taxpayers impacted by the breach are receiving written notices from the IRS, informing them of the unauthorized disclosure of their tax information by an independent contractor. The letter directs taxpayers to a statute enclosed with the letter and advises them about their rights under the Crime Victims’ Rights Act. The letter also provides a link to the website related to the Littlejohn case and an email address for the Department of Justice for additional information. The IRS recommends consulting with an attorney if taxpayers have questions regarding the breach and potential damages.
Damages in a civil suit related to the breach will depend on the extent of the disclosures and whether the taxpayer can prove damages caused by Littlejohn. Damages are limited to $1,000 for each act of unauthorized inspection or disclosure, or actual damages if greater. Punitive damages may also be awarded if the disclosure was willful. Taxpayers may also be entitled to costs and reasonable attorney fees. The IRS encourages all taxpayers to opt-in to the Identity Protection Personal Identification Number (IP PIN) program to protect themselves from identity theft and tax-related identity theft. Taxpayers can obtain an IP PIN online or through a Taxpayer Assistance Center.
