In April 2024, the IRS sent notices informing more than 70,000 taxpayers that their tax and personal data had been stolen in 2019 by a former IRS contractor, Charles Littlejohn. Littlejohn not only stole the data of hundreds of thousands of taxpayers, but also leaked tax returns to ProPublica and the New York Times, including those of President Trump. The IRS sent a second set of notices in the Fall of 2024 to additional affected taxpayers, with more notices expected in the coming months. The stolen information likely includes Social Security numbers, Employer Identification Numbers, and information reported on IRS Form 1099, in addition to tax information reported on returns. Taxpayers receiving notices include partnerships, whose returns include the Schedule K-1 and personal identifying information of each partner.

The IRS faced criticism for the first Littlejohn notices being late, incomplete and lacking essential information. It attributed the delays to the complexity of securely and accurately verifying the vast number of affected taxpayers, making it impossible to include all necessary details or reach every affected taxpayer in the early rounds of notices. The Fall 2024 notices are equally sparse, and it is likely that future notices will be as well.

Affected taxpayers may face hurdles in seeking compensation, as the Internal Revenue Code caps damages for unauthorized disclosure of tax returns at the greater of $1,000 or actual damages suffered from the disclosure. Despite the challenge of proving actual damages, at least two taxpayers have filed lawsuits, with one case ongoing, and the other settled with a public IRS apology to affected taxpayers.

With further notices expected in the coming weeks, the timeline for resolution remains unclear. Taxpayers receiving these notices should consult their tax advisors to understand the potential impact and next steps.