www.forbes.com
Open in
urlscan Pro
151.101.129.55
Public Scan
URL:
https://www.forbes.com/sites/kellyphillipserb/2024/05/01/irs-is-notifying-taxpayers-who-were-victims-of-massive-data-br...
Submission: On May 13 via manual from US — Scanned from US
Submission: On May 13 via manual from US — Scanned from US
Form analysis 1 forms found in the DOM
<form id="zephr-registration-form-M-l1TsBw" class="zephr-registration-form" style="--zephr-color-text-main:#000000;
--zephr-color-text-tinted:#333333;
--zephr-color-background-main:#FFFFFF;
--zephr-color-background-tinted:#cccccc;
--zephr-color-accent-main:#DCF1FB;
--zephr-color-accent-tinted:#81cdf1;
--zephr-color-action-main:#006EDB;
--zephr-color-action-tinted:#0f87ff;
--zephr-color-warning-main:#D90B00;
--zephr-color-warning-tinted:#ff190d;
--zephr-typography-title-font:Roboto;
--zephr-typography-title-fallbackFont:sans-serif;
--zephr-typography-body-font:Roboto;
--zephr-typography-body-fallbackFont:sans-serif;
--zephr-button-fontWeight:normal;
--zephr-button-fontSize:16;
--zephr-button-borderWidth:0;
--zephr-button-borderRadius:9;
--zephr-button-height:50;
--zephr-input-borderColor:#333333;
--zephr-input-borderWidth:1;
--zephr-input-borderRadius:5;
--zephr-input-height:50;
">
<div class="zephr-registration-form-text svelte-i1fi5">
<h4>Sign in or create your account</h4>
</div><label class="zephr-registration-form-input-label svelte-1ok5fdj" for="zephr-registration-form-identifier-M-l1TsBw" style=""><span class="svelte-1ok5fdj">Email</span> </label>
<div class="zephr-registration-form-relative-container"><input id="zephr-registration-form-identifier-M-l1TsBw" name="email" required="" type="email" placeholder="Enter your email"
class="zephr-registration-form-input zephr-registration-form-input-email svelte-blfh8x" autocomplete="username"> </div><button class="zephr-registration-form-button svelte-17g75t9" type="submit" disabled="">Sign In Or Register</button>
<div class=" svelte-1wyy3bx" id="zephr-recaptcha-badge-M-l1TsBw"></div>
<div class="zephr-registration-form-divider-container svelte-mk4m8o">
<div class="zephr-registration-form-divider-line svelte-mk4m8o"></div> <span class="zephr-registration-form-divider-text svelte-mk4m8o">OR USE</span>
<div class="zephr-registration-form-divider-line svelte-mk4m8o"></div>
</div>
<div class="social-sign-in-flex-container">
<div class="zephr-registration-form-button zephr-registration-form-social-sign-in-button svelte-gp4ky7">
<div class="zephr-registration-form-flex-container zephr-registration-form-social-sign-in svelte-gp4ky7">
<div class="zephr-registration-form-social-sign-in-icon svelte-gp4ky7"><svg class="zephr-registration-form-social-sign-in-icon zephr-registration-form-google-icon svelte-1jnblvg" viewBox="0 0 533.5 544.3" xmlns="http://www.w3.org/2000/svg">
<path d="M533.5 278.4c0-18.5-1.5-37.1-4.7-55.3H272.1v104.8h147c-6.1 33.8-25.7 63.7-54.4 82.7v68h87.7c51.5-47.4 81.1-117.4 81.1-200.2z" fill="#4285f4"></path>
<path d="M272.1 544.3c73.4 0 135.3-24.1 180.4-65.7l-87.7-68c-24.4 16.6-55.9 26-92.6 26-71 0-131.2-47.9-152.8-112.3H28.9v70.1c46.2 91.9 140.3 149.9 243.2 149.9z" fill="#34a853"></path>
<path d="M119.3 324.3c-11.4-33.8-11.4-70.4 0-104.2V150H28.9c-38.6 76.9-38.6 167.5 0 244.4l90.4-70.1z" fill="#fbbc04"></path>
<path d="M272.1 107.7c38.8-.6 76.3 14 104.4 40.8l77.7-77.7C405 24.6 339.7-.8 272.1 0 169.2 0 75.1 58 28.9 150l90.4 70.1c21.5-64.5 81.8-112.4 152.8-112.4z" fill="#ea4335"></path>
</svg></div> Continue with Google
</div>
</div>
<div class="zephr-registration-form-button zephr-registration-form-social-sign-in-button svelte-gp4ky7">
<div class="zephr-registration-form-flex-container zephr-registration-form-social-sign-in svelte-gp4ky7">
<div class="zephr-registration-form-social-sign-in-icon svelte-gp4ky7"><svg id="" class="svelte-fa svelte-1cj2gr0" style="height:1em;line-height:.75em;font-size:1.33333em;vertical-align:-.225em;transform-origin:center;overflow:visible"
viewBox="0 0 512 512" aria-hidden="true" role="img" xmlns="http://www.w3.org/2000/svg">
<g transform="translate(256 256)" transform-origin="128 0">
<g transform="translate(0,0) scale(1,1)">
<path
d="M504 256C504 119 393 8 256 8S8 119 8 256c0 123.78 90.69 226.38 209.25 245V327.69h-63V256h63v-54.64c0-62.15 37-96.48 93.67-96.48 27.14 0 55.52 4.84 55.52 4.84v61h-31.28c-30.8 0-40.41 19.12-40.41 38.73V256h68.78l-11 71.69h-57.78V501C413.31 482.38 504 379.78 504 256z"
fill="#1877f2" transform="translate(-256 -256)"></path>
</g>
</g>
</svg></div> Continue with Facebook
</div>
</div>
</div>
</form>Text Content
Subscribe To Newsletters Subscribe: $49.99/year Sign In BETA This is a BETA experience. You may opt-out by clicking here Edit Story ForbesMoneyTaxes PremiumEditors' Pick IRS NOTIFYING TAXPAYERS WHOSE DATA WAS ACCESSED IN LEAK THAT HIT BILLIONAIRES AND TRUMP Charles Littlejohn got five years in jail for leaking tax return info for billionaires Musk, Bezos, Bloomberg and Buffett. But he improperly accessed other taxpayers’ records too. Kelly Phillips Erb Forbes Staff Kelly Phillips Erb is a Forbes senior writer who covers tax. FollowingFollow Click to save this article. You'll be asked to sign into your Forbes account. Got it May 1, 2024,10:56pm EDT * Share to Facebook * Share to Twitter * Share to Linkedin Security system design concept. getty The IRS is now notifying more taxpayers who were impacted by the Littlejohn data breach. Former IRS contractor Charles Littlejohn illegally accessed and distributed to certain news organizations the private tax information of corporate and wealthy individual taxpayers, including former President Donald Trump and fellow billionaires Elon Musk, Jeff Bezos, Warren Buffett and Michael Bloomberg. But he also disclosed tax return information of thousands of others. The IRS is required, by law, to give notice to any other victims of the breach if can identify, even if their names were never published. It is doing so now. BACKGROUND According to court documents, from about 2017 to 2021, Littlejohn was employed as a government contractor for an unnamed consulting firm that serviced public and private clients. As part of his job, he worked on contracts that the firm had obtained through the IRS. The returns and return information were disclosed to Littlejohn for "purposes of tax administration." Court documents also reveal that Littlejohn turned over returns and return information dating back more than 15 years covering thousands of the nation's wealthiest people to "News Organization 2" (News Organization 2, which was not explicitly named in the charges, published over 50 articles using the stolen data. That appeared to match reporting by Pro Publica in 2021, a fact later confirmed in the sentencing memorandum.). He provided the data by mailing it to a password-protected personal data storage device. The data contained not only tax returns but also investments, stock trades, gambling winnings, audit determinations, and many other types of financial material. Littlejohn accessed the returns on an IRS database after using broad search parameters designed to conceal the true purpose of his queries. He then evaded IRS protocols established to detect and prevent large downloads or uploads from IRS devices or systems before saving the tax returns to multiple personal storage devices, including an iPod. Littlejohn was initially charged on information on September 29, 2023, with one count of disclosing tax return information without authorization. Generally, being charged on information means that a defendant has agreed to plead guilty and waived the right to an indictment—that's what appears to have happened here. The following month, Littlejohn pleaded guilty to unauthorized disclosure of tax return and return information—a violation of section 7213(a)(1) of the tax code, the most serious offense for leaking tax information. In January of 2024, Littlejohn was sentenced to five years in prison for disclosing thousands of tax returns—including Donald Trump's tax returns—without authorization. IMPACT The IRS has not publicly indicated how many letters it will be sending out related to the breach, though it’s been suggested that it could be in the thousands. Here’s what we do know. On May 1, 2023, the government filed an unopposed Motion to Provide Alternative Victim Notification Pursuant to 18 USC § 3771(d)(2) in the case. The government noted in the motion that it has identified "at least 152 victims whose tax information was published by the media as a result of the charged unauthorized disclosure." According to the Motion, the government had provided individual notifications of this investigation and the rights crime victims have under the Crime Victims' Rights Act (CVRA) to those 152 identified victims via mail and telephone calls. The government said it would continue to provide individual notifications of court hearings to those identified victims. The government also indicated that it had information that Littlejohn disclosed the tax return information of thousands more individuals, but the media did not publish those individuals' information. The government posited that individual notification to all of the thousands of additional potential victims, many of whom the investigative agency was still trying to identify at the time, would be impractical. The government proposed providing public notice on the Department of Justice (DOJ) website. The website, the government proposed, would give a summary of the case, information regarding the case's status, including the dates and times of hearings, and other significant case-related documents, such as the charging documents and plea agreement. The website, it said, would also contain an email address through which individual potential crime victims could contact the DOJ with questions regarding the case. The government noted that the courts have allowed this kind of notice in several cases, including United States v. Madoff. ALTERNATIVE NOTICE The Motion for alternative notice was granted on October 10, 2023, with the court finding that (1) the number of potential victims in this case makes it impracticable to provide all of the victims the rights provided under 18 USC § 3771(a); (2) the "[m]ultiple crime victims" provision of the Crime Victims' Rights Act applies to this case, id. § 3771(d)(2); and (3) the means of notifying potential victims set forth in the motion constitute a "reasonable procedure" to give effect to and ensure compliance with the notice provisions of the Act. (You can find the website, updated in February 2024, here.) STATUTORY OBLIGATION Under section 7431(e) of the tax code, if a person is criminally charged with unauthorized inspection or disclosure of a taxpayer's return or return information, the Secretary of the Treasury must notify the taxpayer as soon as possible. The notice must include the date of the unauthorized inspection or disclosure and the rights of the taxpayer. The notice is not required to provide information about what specific was disclosed. CIVIL DAMAGES Under section 7431(a), victims may be able to sue for damages for the unauthorized inspection or disclosure of their tax information. If the accused person is an officer or employee of the United States, the taxpayer may sue the United States in district court. If the accused person is not an officer or employee of the United States, the taxpayer may sue the individual. Littlejohn was an independent contractor, and the government has argued that means that he was not an employee of the United States. That argument has yet to be fully tested in court—but it likely will be. There is a case, Kenneth Griffin v. Internal Revenue Service, currently being heard in the U.S. District Court, Southern District of Florida (Miami), where the issue is already being raised. Griffin, the founder and Chief Executive Officer of Citadel, a global alternative investment firm, and a founder and the non-Executive Chairman of Citadel Securities, a leading global market maker, has filed suit against the IRS for “their willful and intentional failure to establish appropriate administrative, technical, and/or physical safeguards over its records system to insure the security and confidentiality of Mr. Griffin’s confidential tax return information.” Griffin’s information was included in the data leaked to Pro Publica and he filed suit months before Littlejohn was revealed to be the leaker. After that discovery, Griffin amended his complaint, but the IRS continues to argue for dismissal, noting, “Since Littlejohn was not an officer or employee of the IRS, Mr. Griffin’s claim for damages in Count I lies not against the United States (as pleaded) under § 7431(a)(1), but rather against Littlejohn under § 7431(a)(2).” Last month, the court admitted that there were questions as to whether the claim could properly be brought, but continued to allow it, writing, “Whether the evidence ultimately supports the complaint’s allegations that Littlejohn was an IRS employee remains to be seen. But, at least for now, the Court finds the Government’s challenge to subject-matter jurisdiction falls short.” That could open doors for future challenges. Clearly, taxpayers would prefer to file suit against the United States as opposed to Littlejohn, who is currently spending time in jail—there’s no indication that he would have assets sufficient to pay damages. Written Notice It's unclear why the IRS is now sending out notices, but taxpayers are reporting that they have received Letter 6613-A, IRC 7431(e) Notification Letter. As noted earlier, the IRS is required to notify taxpayers when any person has been criminally charged with the unauthorized disclosure or inspection of taxpayer returns or return information in violation of section 6103. The most common result is a form letter, Letter 6613. In this case, Letter 6613-A indicates that an IRS contractor has been charged with the unauthorized disclosure or inspection of the taxpayer’s tax return or return information. The letter indicates that an IRS independent contractor—not named in the letter, but clearly referencing Littlejohn—was charged with the unauthorized disclosure of the taxpayer's information between 2018 and 2020. The letter then directs taxpayers to the statute, a copy of which is enclosed with the letter, and advises taxpayers about the Crime Victims' Rights Act (CVRA). You can find out more about the CVRA here. The letter includes a link to the website related to the Littlejohn case and, as noted in the government's Motion, provides an email address for the DOJ if taxpayers need more information. Finally, the letter recommends consulting with an attorney if taxpayers have questions. As noted on the website, "Although the statute specifically sets forth your right to seek advice of an attorney with regard to your rights under the statute, there is no requirement that you retain counsel. The Government may not recommend any specific counsel, nor can the Government (or the Court) pay for counsel to represent you. Government attorneys represent the United States." DAMAGES One of the primary issues in a civil suit will be whether—and how much—damages might have been suffered. That's difficult for some taxpayers since the extent of the disclosures may not be initially known. And, importantly, the taxpayers would have to prove that Littlejohn was responsible for the damages. By statute, under section 7431(c), damages are limited to the greater of $1,000 for each act of unauthorized inspection or disclosure or the actual damages. If the disclosure was willful—as here—the taxpayer may also be entitled to punitive damages. Taxpayers may also be entitled to costs and reasonable attorney fees (with the caveat that if the suit is filed against the United States, reasonable attorney fees may be awarded only if the taxpayer wins). TAXPAYER PROTECTION A data breach like this one—where accessing taxpayers' accounts for financial gain wasn't the primary goal—doesn't necessarily mean your personal information is at risk. As the IRS notes, "Not every data breach will result in identity theft, and not every identity theft is tax-related identity theft." Taxpayers who have concerns about what data might have been compromised and whether there is a risk moving forward should consult with a tax professional. The IRS encourages those taxpayers—and, in fact, "everyone"—to opt-in to the Identity Protection Personal Identification Number (IP PIN) program. If you don't have an IP PIN, you can get one by going to irs.gov/ippin. If you can’t get one online, you can schedule an appointment at your closest Taxpayer Assistance Center by calling 1-844-545-5640. You can also file Form 15227 to apply for an IP PIN by mail or fax—however, to qualify to file a paper form by mail or fax, your adjusted gross income on your last filed return must be below $79,000 for individuals or $158,000 for married taxpayers filing jointly. For more, check out irs.gov/ippin. ForbesIRS Contractor Pleads Guilty To Stealing And Disclosing Tax Return InformationBy Kelly Phillips Erb ForbesFormer IRS Contractor Will Go To Jail For Disclosing Trump's Tax ReturnsBy Kelly Phillips Erb Follow me on Twitter or LinkedIn. Send me a secure tip. Tax Breaks: Timely tax tips and the latest news delivered to your inbox weekly Kelly Phillips Erb FollowingFollow Kelly Phillips Erb is a Philadelphia-area Forbes senior writer who covers tax and financial crimes. As a tax attorney, Phillips Erb brings a legal perspective to her tax coverage. This has ... Read More * Editorial Standards * Print * Reprints & Permissions SIGN IN OR CREATE YOUR ACCOUNT Email Sign In Or Register OR USE Continue with Google Continue with Facebook FREE FORBES INVESTMENT REPORT 12 Stocks To Buy Now The fuse has been lit: a massive bull market is underway. Forbes has run the numbers and done the research to come up with some of the best companies poised to surge higher than most in the expansion ahead. Get their names in our latest report, 12 Stocks To Buy Now. Your free report includes •A Warren Buffett and Mario Gabelli-backed sports management company that went public only last year and whose revenue jumped 9% and poised to grow more • An undervalued innovator in crop protection trading at a ridiculously low price multiple amidst surging sales. It's still $12, but not for long • An under-the-radar investment powerhouse that's paying an astonishing 10% dividend • ... and more! Learn More FREE FORBES INVESTMENT REPORT Build Your Wealth Further in 2024 With The Forbes Investment Bundle - Save 80% Make 2024 your most profitable year yet with Forbes' biggest sale. Get 3 powerhouse advisories - Forbes Investor, Forbes Dividend Investor and Forbes.com membership, plus our award-winning Forbes magazine, at one unbelievable price. Value at $480 - only $99. Ends soon! Get The Forbes Investment Bundle Continue Reading PREMIUM Fuel your progress. Invest in your success. Become a member and unlock exclusive access to diverse, in-depth journalism not available anywhere else. Join a community of visionaries, entrepreneurs and thought leaders who shape the world. Already a member? Sign in $6.99 Billed Monthly Subscribe SAVE 42% $49.99 Billed Annually Subscribe $99 Billed Every Two Years Subscribe Subscriptions renew automatically. You may cancel your subscription at any time. Benefits Premium access to exclusive events, thought-provoking conversations with global leaders and more, all available on-demand. Elevated browsing experience with fewer ads and unlimited article saving power an enhanced reading experience. Back to the Home page auto PREMIUM Want to save more articles? Subscribe today. You've reached your limit of articles you can save without a subscription. Subscribe now to save as many articles as you want. Premium Journalism, deeply reported stories and breaking news Members-only events Subscribe Subscriptions renew automatically. You may cancel your subscription at any time.