IRS leak of private data goes beyond billionaires

While critics express outrage over Elon Musk’s access to sensitive taxpayer data, the IRS continues to alert thousands of businesses and individuals that their tax information was leaked to a news organization that published dozens of articles on some hacked files.

ProPublica, funded partly by liberal donors including George Soros, has published nearly 50 articles on what it described as “a massive trove of taxpayer information” stolen by government contractor Charles E. Littlejohn and provided to the group.

The publication suggested the stolen data was from only the nation’s wealthiest. Jen Pera, a single mother of two from Austin, Texas, was among the thousands who received letters from the IRS informing them they were also caught up in Littlejohn’s unlawful access and leak of tax information to the publication.

Ms. Pera, neither a billionaire nor a millionaire, received two letters — the first in June and a second in December — notifying her that Littlejohn had accessed her individual tax return information and potentially leaked it to ProPublica.

“How in the world did I get mixed up in that?” Ms. Pera said. “And I don’t have an answer for that because no one has talked to me. I’m definitely not in the tax bracket of the 1%.”

A class-action lawsuit filed last month against the IRS and a government contractor revealed that the leak may have exposed a broader group of taxpayers than the ultrawealthy.

Attorneys in the case suspect the IRS notified or is in the process of notifying “hundreds of thousands of taxpayers” that their information was stolen or illegally accessed by Littlejohn from 2018 through 2020 and may have been handed to ProPublica.

The leak is just one of several recent data breaches at the IRS. Mr. Musk, serving as President Trump’s government efficiency adviser, provoked outrage over plans to gain access to the agency.

Mr. Musk, seeking to eliminate waste, fraud and abuse, wants access to the IRS’s Integrated Data Retrieval System, which contains sensitive taxpayer information. The billionaire co-founder and leader of Tesla, SpaceX and other businesses plans to modernize the antiquated IRS system by embedding U.S. DOGE Service software engineers at the agency.

Democratic lawmakers, unions and at least one taxpayer advocacy group have decried DOGE’s investigation of the IRS as illegal and a threat to privacy. DOGE will reportedly have no access to personal tax information.

Opponents are suing to stop DOGE from gaining access to the IRS.

“This case seeks to protect the privacy and the legal rights of millions of Americans, and thousands of small business owners, who depend upon the IRS,” the Center for Taxpayer Rights and a pair of unions representing government employees argued in court documents.

The IRS has struggled to prevent illegal hacks, which have resulted in massive taxpayer data leaks in recent years.

One of the largest thefts of taxpayer data occurred in 2016 when hackers exploited weaknesses in an online IRS program that provides filers with previous tax returns. The hackers used the program to steal sensitive tax information from more than 300,000 individuals.

Years later, the Treasury Inspector General for Tax Administration continued to find weaknesses in IRS security protocols that exposed the agency to cyberthieves. In 2022, the inspector general found that the IRS had not implemented recommended minimum security countermeasures to stop security breaches.

In 2023, a Government Accountability Office report found “new and continuing control deficiencies” that increase the risk of “unauthorized access to, modification of and disclosure of sensitive data and programs, as well as the disruption of critical operations.”

Working at the IRS as a contractor for Booz Allen Hamilton, Littlejohn uploaded thousands of taxpayer records from 2018 through 2020 and provided them in a USB drive to ProPublica.

The organization has mined the stolen tax records for a lengthy series about ways the wealthy used the tax code to avoid paying “little in income tax compared to their massive wealth — sometimes, even nothing.”

Littlejohn pleaded guilty in October 2023 to unauthorized disclosure of tax returns and is serving a five-year sentence at a medium-security prison. Liberal groups say his theft rightly exposed ways the wealthy use the tax code to pay less in taxes.

A GoFundMe page has raised $60,000, and several liberal groups unsuccessfully lobbied for Littlejohn to receive a pardon from President Biden. Littlejohn also leaked Mr. Trump’s tax records to The New York Times.

ProPublica won’t disclose the number of individuals or businesses whose tax information it possesses. It’s unclear whether all the taxpayers contacted by the IRS had their information leaked to ProPublica or whether Littlejohn merely “accessed” their information.

In a statement to The Wall Street Journal, the publication described its trove as “extremely limited,” but news organization officials have publicly described the haul as “massive” and “vast.”

The publication declined to say whether it would publish additional articles exposing tax information.

“In the essay published alongside the first article in the Secret IRS Files series, ProPublica’s editor-in-chief, Stephen Engelberg, and then-president, Dick Tofel, explained that after careful deliberation, ProPublica published select, newsworthy tax details of some of the richest Americans to inform the debate about the fairness of our tax system. These stories clearly served the public interest and we continue to stand by them,” a ProPublica spokeswoman said.

Articles have revealed the private tax information of “America’s top 15 earners,” including Mr. Musk, Amazon founder Jeff Bezos, investor Warren Buffett and Citadel CEO Ken Griffin. ProPublica revealed additional “data” for the top 400 earners, including former Education Secretary Betsy DeVos, who served in Mr. Trump’s first term and ranks 389th on the ProPublica earners list.

The news outlet reported the earnings and tax rates of ProPublica funders, including Laurene Powell-Jobs, and revealed the earnings and tax rates paid by pop star Taylor Swift and basketball star LeBron James.

Less-prominent taxpayers are wondering whether their private data will be exposed.

In January, Dallas-based Alarm Concepts Inc., a security equipment firm, sued the IRS and Booz Allen Hamilton, the IRS contractor that employed Littlejohn, over the breach.

The IRS notified Alarm Concepts on Dec. 16 that Littlejohn disclosed the company’s tax information, including tax forms, Social Security numbers and other sensitive information in the leak to ProPublica.

Lawyers representing the company said the government has acknowledged the continuing harm to those whose data was leaked to the news outlet.

“ProPublica has continued to publish stories using the disclosed data, even after Littlejohn entered a guilty plea. Alarm Concepts and other victims whose information has been disclosed to a news organization rightly fear that their private, confidential tax information could surface in the news at any time or could be disclosed to other news organizations,” the lawsuit says.

In court documents from a lawsuit brought by Mr. Griffin against the IRS, Littlejohn was asked to quantify the number of people snared in his data leak to ProPublica.

Littlejohn said his “guesstimate” of the “upper limit” of his data theft included 7,500 taxpayers over 16 years of tax filings.

According to the Alarm Concepts lawsuit, the IRS began sending letters to more than 70,000 individuals and businesses in April, warning that their tax information was included in Littlejohn’s data theft. The IRS sent another round of letters to additional taxpayers in December. In May, the IRS indicated that it was working to “fully understand” the scope of Littlejohn’s unlawful access to and disclosure of tax information.

After Littlejohn gave ProPublica the stolen data, he helped reporters generate story ideas. He suggested they use Forbes’ list of the wealthiest Americans and publish what they paid in taxes.

Littlejohn said the reporters assured him they would “keep a tight circle” around who had access to the data.

A ProPublica spokeswoman confirmed that some reporters who wrote the series using the stolen tax information are writing a book.

“The forthcoming book, which will be a popular history of U.S. efforts to tax the rich, is not a ProPublica project and does not involve ProPublica materials, including material from the IRS trove,” a spokeswoman said.

• Stephen Dinan contributed to this report.