More Rich Taxpayers Learn Their Data Was Stolen in Huge IRS Leak

The IRS sent another wave of letters to taxpayers whose data was stolen amid a historic breach by an agency contractor several years ago.

Charles Littlejohn stole the tax returns of prominent billionaires and President Donald Trump between 2018 and 2020 and then leaked them to news organizations, which published a series of stories with the information. The notices are the first time those not named in the news articles realized they were part of the breach.

The tax return information for almost 100,000 individuals and businesses was included in the data Littlejohn stole, according to an email from Department of Justice attorney Jonathan Jacobson, which was released Jan. 8 as part of Littlejohn’s appeal of his sentence. Littlejohn was sentenced to five years in federal prison last January. The scope of the breach was difficult for the government to determine, and the IRS said it didn’t get access to what was stolen until after Littlejohn’s sentencing, which may have contributed to notices coming years after the crime.

The IRS didn’t immediately respond to a request for comment.

The recent letters to taxpayers are labeled CP 118 and include no specific information about what was stolen. Bloomberg Tax received a copy of the letter. The format echoes letters sent last April, which also had few details, frustrating taxpayers.

“There’s definitely a lot of concern about what information has been seen,” said Marissa Lenius, a senior manager of tax controversy at RSM US LLP.

The most recent letters to taxpayers come as House Judiciary Committee Chair Jim Jordan (R-Ohio) is seeking more information on the breach.

Scope of Breach

The government had trouble determining the exact number of returns stolen because Littlejohn copied records from an IRS database “using queries that produced large tranches of tax data,” Jacobson said in the email, which was released as part of a statement of unrecorded proceedings in Littlejohn’s appeal.

The government estimated 8,000 income tax returns were stolen, about 7,600 of which were individuals, according to the email.

But the legal definition of “return” includes any tax or information return, such as Schedule K-1 forms filed by partnership members. With that broader definition, the breach impacts 18,000 individuals and 73,000 businesses whose information was linked in some way to the 8,000 income tax returns, according to Jacobson’s email.

Michael Bloomberg was among those included in the reporting. Bloomberg Tax is operated by entities controlled by Bloomberg.

Decoding the Notices

The recent CP 118 letters are computer generated, as indicated by the “CP” prefix, which stands for “computer paragraph.” That may indicate that more taxpayers received them than the previous letters in April, which were labeled Letter 6613-A, said Brett Bissonnette, a principal at Plante & Moran PLLC.

“The Government’s analysis of the material received from the contractor indicates that your information was narrow in scope and limited to information returns,” the CP 118 letter reads.

Bissonnette and Lenius saw both businesses and individuals receive letters in the April and December waves.

It’s unclear why more letters went out in December.

The IRS told taxpayers who requested more information after receiving April letters that the agency didn’t receive access to information regarding all affected taxpayers until Littlejohn was sentenced.

The first wave of notices to “a subset of impacted individuals” went out in January 2024, according to an email from Michael Oser, acting director of IRS identity and records protection, obtained by Bloomberg Tax through a Freedom of Information Act request.

The next set of letters went out April 12 to 69,000 impacted business entities, according to the April 2024 email. The email said there would be three sets of notifications to taxpayers affected by the breach.