Some of the nation’s wealthiest individuals had their tax return information unlawfully accessed or disclosed in what may be the largest recorded data breach in the history of the Internal Revenue Service (“IRS”). The IRS recently began notifying victims (including more than 70,000 companies and individuals). As the IRS has recently acknowledged, the full scope of this breach is currently unknown, and the ramifications may be far-reaching, but steps can be taken to mitigate further damage.

Earlier this year, Charles Littlejohn (“Littlejohn”) was sentenced to five years in federal prison for his unlawful disclosure of confidential taxpayer information. U.S. v. Littlejohn, Docket No. 1:23-cr-00343-ACR (D.C.). According to court documents, Littlejohn, a former employee of Booz Allen Hamilton, Inc. (“Booz Allen”), who, while working on a government contract for the IRS in 2020, used his position to unlawfully access and disclose to two news organizations confidential tax return information of thousands of wealthy taxpayers, including billionaire Elon Musk, former President Donald Trump, and Bloomberg L.P. co-founder Michael Bloomberg.

One of the impacted taxpayers, hedge fund manager Ken Griffin, recently filed a lawsuit against the IRS and the Treasury Department, claiming, among other things, that these agencies are liable for the Littlejohn data breach that resulted in the unlawful disclosure of Ken Griffin’s confidential tax return information. The Government filed a motion to dismiss, asserting, among other things, that the Court lacked jurisdiction because Littlejohn was a contractor and not an employee of the IRS. On April 22, 2024, the Court partially denied the motion. Griffin v. Internal Revenue Service et al., Docket No. 1:22-cv-24023-RNS (S.D. Fla.).

In a separate lawsuit, a plaintiff has asserted a different argument, that Littlejohn was not an employee of the IRS, but rather an employee of Booz Allen, and that Booz Allen is liable for the data breach. This lawsuit alleges, among other things, that Booz Allen failed to take adequate protective measures, which resulted in the unlawful disclosure of his confidential tax return information. Warren v. Booz Allen Hamilton, Inc., Docket No. 8:24-cv-01252-LKG (D. Md.). Both the Warren and Griffin cases are pending.

Although the Littlejohn data breach occurred in 2020, the IRS only recently began issuing disclosure notice letters (Letters 6613-A) in April 2024, alerting victims of its data breach and recommending steps to redress the breach. Letter 6613-A is not a general notice to all taxpayers – if a taxpayer receives Letter 6613-A, then the IRS believes that that particular taxpayer’s information was unlawfully accessed or disclosed. In an announcement released on May 10, 2024, the IRS disclosed that the full scope of disclosure is still unknown and also stated:

To begin with, it should be stressed that this incident was unacceptable. Any improper access or disclosure of confidential taxpayer information is unacceptable, and it is completely at odds with the IRS’s values and the agency’s commitment to taxpayers.

We recognize that this incident has created a difficult situation for many taxpayers, including individuals as well as business entities. We also recognize that it is incumbent on the IRS not only to protect confidential taxpayer information, but also to address matters to the fullest extent possible when any such information is unlawfully disclosed.

Anyone receiving Letter 6613-A should consult with tax counsel regarding next steps to safeguard their tax return information and to take action with respect to the IRS.