The IRS is informing taxpayers affected by the Littlejohn data breach, where former IRS contractor Charles Littlejohn accessed and shared private tax information illegally. Littlejohn worked as a government contractor for a consulting firm from 2017 to 2021, receiving tax information through contracts obtained by the IRS. He leaked tax returns of thousands of individuals, mailing the data to a personal storage device for a news organization to publish. Littlejohn accessed the returns using deceptive search parameters and evaded IRS protocols to save the data to personal devices, resulting in him being charged and sentenced to five years in prison for unauthorized disclosure of tax information, including that of Donald Trump.
The impact of the breach is significant, with the government identifying at least 152 victims whose tax information was published. The letters containing the notifications are being sent to inform impacted taxpayers of their rights and provide information on the crime victims’ rights act. Due to the impracticality of individually notifying all potential victims, the government has proposed providing public notice on the Department of Justice website. The court has granted the motion for alternative notice, allowing the government to use reasonable procedures to ensure compliance with the crime victims’ rights act.
Under the tax code, the Secretary of the Treasury is obligated to notify taxpayers when there is a criminal charge related to unauthorized access or disclosure of their tax information. Victims have the right to sue for damages under section 7431, with the ability to file against either the individual responsible for the breach or the United States. A current case involving a lawsuit against the IRS by Kenneth Griffin raises questions about whether the accused individual, like Littlejohn, was an employee of the United States and if damages can be sought from the government.
Taxpayers impacted by the breach have reported receiving notification letters from the IRS, informing them of the unauthorized disclosure of their tax information by an independent contractor. The letter provides details of the breach, directs taxpayers to the statute, and advises them on their rights under the Crime Victims’ Rights Act. The letter includes a link to the website related to the case and advises consulting an attorney for more information.
In a civil suit, taxpayers may seek damages for unauthorized inspection or disclosure of their tax information, proving that the breach caused actual damages and that the individual responsible was at fault. Damages are limited by statute but may include punitive damages for willful disclosures. To protect against future breaches, the IRS recommends taxpayers opt-in to the Identity Protection Personal Identification Number (IP PIN) program, which adds an extra layer of security to their tax accounts. Taxpayers with concerns about the breach should consult a tax professional for guidance on potential risks and protective measures to take moving forward.