On April 12, 2024, the Internal Revenue Service began notifying thousands of taxpayers that their tax return information was subject to a data breach perpetrated by an independent contractor working for the IRS. During 2018 through 2020, Charles Littlejohn stole the tax return information of thousands of high-net-worth individuals and their related entities and disclosed it to ProPublica and other entities. ProPublica used this tax return information to publish a series of articles about high-profile taxpayers, disseminating sensitive financial data to the public. Littlejohn pleaded guilty to disclosing return information without authorization and was sentenced to five years in prison in January 2024. Now, four years after the data breach, the IRS is notifying affected taxpayers, who are pondering the impact of the breach and what to do about it.

Background on Tax Disclosure Rules

I.R.C. § 6103 prohibits the unauthorized disclosure of tax returns or return information by any officer or employee of the United States, any State or any local law enforcement agency, or any other person who has had access to returns or return information. A return includes any tax or information return, declaration of estimated tax, or claim for refund, including any supporting schedules or attachments. Tax return information is defined broadly to include (i) a taxpayer’s identity, (ii) information about the nature, source or amount of his income, receipts, deductions, exemptions, assets, liabilities, net worth, or tax liabilities, withholdings, deficiencies, or payments, (iii) whether the taxpayer has been subject to an examination or investigation, and (iv) any other information provided to, collected, or prepared by the IRS. A disclosure includes any act of making known a return or return information to any person in any manner.

The Internal Revenue Code provides civil and criminal penalties for unauthorized disclosures under I.R.C. § 6103. A taxpayer may bring a civil action for damages against the United States where any officer or employee knowingly or negligently makes an unauthorized disclosure under I.R.C. § 6103. Where a taxpayer establishes that an unauthorized disclosure has occurred, he or she may recover the greater of (i) statutory damages of $1,000 per disclosure; or (ii) the sum of actual damages. Punitive damages may also be awarded where the plaintiff establishes that the unauthorized disclosure was willful or grossly negligent. Civil actions for violations of I.R.C. § 6103 must be brought within two years of the plaintiff’s discovery of the unauthorized disclosure.

The willful disclosure of tax returns and return information may also be punishable as a felony under I.R.C. § 7213. Littlejohn was prosecuted under this statute.

What Does the IRS Disclosure Notification Say?

The IRS issued Letters 6613-A to affected taxpayers notifying them of the Littlejohn data breach. The letters state that an IRS independent contractor was charged with the unauthorized disclosure of the affected taxpayer’s return or return information between 2018 and 2020. The letters indicate that the Department of Justice is prosecuting this matter. Affected taxpayers who want more information about the status of the criminal prosecution or the Crime Victims’ Rights Act are directed to the Department of Justice’s website at Justice.gov/criminal-vns/case/united-states-v-charles-littlejohn. Affected taxpayers who have questions about the Crime Victims’ Rights Act may also email the Department of Justice at CRM-PEN.Victims@usdoj.gov. These taxpayers can also send email inquiries seeking additional information to the IRS at Notification.7431@irs.gov, but it is unclear what information the IRS will provide. According to the letters, I.R.C. § 7431 authorizes civil actions for unauthorized disclosures of return information. Letters 6613-A direct affected taxpayers to consult with an attorney to determine whether they have a private right of action in connection with the unauthorized disclosure.

What Options Are Available for Affected Taxpayers?

• Safeguarding Your Personal Identity

Although four years have elapsed between the unauthorized disclosures and the IRS notification, taxpayers who have received Letters 6613-A should consider taking steps to safeguard their personal identity. These steps may include (i) applying for an Identity Protection PIN from the IRS to prevent third parties from filing fraudulent tax returns using their social security number or EIN; (ii) periodically reviewing their tax transcripts to ensure there is no fraudulent activity; (iii) monitoring their credit reports to ensure their personal information has not been used for fraudulent activity; and (iv) asking the IRS if it plans to provide identity monitoring services to those affected by the breach.

• Pursuing a Civil Action

Affected taxpayers may also consider pursuing a civil action against Littlejohn and/or the IRS. Currently, there is one case pending against the IRS in the U.S. District Court for the Southern District of Florida involving Littlejohn’s unauthorized disclosures. Recently, the court denied the government’s motion to dismiss the plaintiff’s I.R.C. § 7341 claim but dismissed the plaintiff’s alternative Privacy Act claim for failure to allege actual damages. The outcome of the case remains to be seen, but it demonstrates that there are multiple issues to consider in determining whether to pursue a civil action against the IRS.

Littlejohn was sentenced to five years in prison and is unlikely to be able to satisfy a judgment, so affected taxpayers may wish to pursue claims against the IRS. It is an open question whether Littlejohn would be treated as an IRS employee under the statute and whether the IRS would be held liable for his conduct. In the pending case involving the disclosures made by Littlejohn, the government argued in its motion to dismiss that Littlejohn was not an IRS employee. The U.S. District Court for the Southern District of Florida denied the motion on the I.R.C. § 7431 claim and allowed the case to proceed to discovery.

There are many issues concerning the ability to establish damages. The statutory damages awarded under I.R.C. § 7431 are minimal (i.e., $1,000) unless the plaintiff can prove actual damages, which may be challenging. In addition to showing that the damages occurred, the plaintiff must establish that the defendant’s conduct caused the damages. This may be difficult to establish in the absence of actual harm linkable to this particular breach, especially where over four years have elapsed between the unauthorized disclosure and the IRS’s notification of the data breach.

The minimum statutory damages are $1,000 per disclosure. Here, where Littlejohn disclosed the return information to a news organization, which published a series of articles, how many disclosures occurred? The circuit courts are split on the issue of whether the disclosure constitutes a single disclosure to the news organization or should be treated as multiple, separate disclosures to the publication’s readers.

Finally, I.R.C. § 7431 allows for punitive damages where the disclosure is willful. The circuit courts are also split on the issue of whether a plaintiff must establish actual damages before punitive damages can be imposed.

I.R.C. § 7431 requires that the IRS notify a taxpayer if any person is criminally charged with an unlawful disclosure of the taxpayer’s return or return information “as soon as practicable.” Whether the IRS’s four-year delay in notifying affected taxpayers satisfies this requirement is an open question given the criminal investigation and prosecution that was proceeding during those years.

Fund Considerations

In addition to the many individuals affected by Littlejohn’s actions, many partnerships, funds, and other entities were also victims of the breach. These entities may wish to consider their obligation to notify impacted investors, whom the IRS may not have notified directly.

Conclusion

Four years have passed since Littlejohn’s unauthorized disclosures. Nevertheless, affected taxpayers who receive Letters 6613-A should take steps to safeguard their personal identify. Affected taxpayers may also wish to consult with an attorney to determine whether a civil action is appropriate and worthwhile in their circumstances.