Cyber Incident Victim: Internal Revenue Service
Date:
Jan 2018
Location:
United States of America
Summary
A former contractor employed by Booz Allen Hamilton improperly accessed and disclosed confidential tax return information of high-profile individuals and approximately 405,000 taxpayers, predominantly business entities, by exploiting IRS systems and evading security protocols. The contractor stole sensitive data including returns, audit details, and financial records, transferring it to personal devices before leaking it to media outlets. Following a criminal prosecution resulting in a maximum five-year prison sentence for the individual, the Treasury Department terminated all contracts with the contractor's employer, citing failures in safeguarding taxpayer data. The breach prompted IRS notifications to affected parties, public apologies, and legal claims against both the agency and the contracting firm, which denied systemic responsibility by characterizing the incident as isolated misconduct. The fallout intensified scrutiny over taxpayer privacy amid broader government data-sharing controversies.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The incident involved unauthorized disclosure of confidential taxpayer information by Charles Edward Littlejohn, a former contractor employed by Booz Allen Hamilton who worked on IRS systems. Between 2018 and 2020, Littlejohn stole tax returns and related financial data belonging to high-profile individuals including Donald Trump, Elon Musk, Jeff Bezos, Warren Buffett, and Michael Bloomberg. He accessed IRS databases using broad search parameters intended to conceal his activities, evaded detection protocols designed to prevent large data transfers, and stored the stolen information on personal devices such as an iPod. Littlejohn initially leaked Trump’s tax records to the New York Times and later provided 15 years of financial data on other billionaires to ProPublica. The compromised material included not only tax returns but also investment details, stock trades, gambling records, audit determinations, and information from passthrough entities that exposed additional taxpayers through Forms K-1. In October 2023, Littlejohn pleaded guilty to violating 26 U.S.C. § 7213(a)(1) for unauthorized disclosure of tax information and received the maximum sentence of five years imprisonment. Subsequent IRS disclosures revealed the breach affected approximately 405,000 to 406,000 taxpayers, with business entities constituting the majority of victims.
The Treasury Department terminated all 31 contracts with Booz Allen Hamilton in January 2026, citing the firm’s failure to safeguard taxpayer data, amounting to $4.8 million in annual spending and $21 million in total obligations. The IRS began notifying affected taxpayers through mailed letters in late 2023 and extended these notifications into 2024, later acknowledging the breach to Congress and issuing rare public apologies to victims whose data was disclosed to media outlets. Legal actions against the IRS were limited due to Littlejohn’s contractor status, though multiple lawsuits targeted Booz Allen for alleged negligence in monitoring employee access to IRS systems. Booz Allen maintained that Littlejohn acted as a rogue operator who concealed his activities on government networks, emphasizing that the company stores no taxpayer data on its own systems. The breach amplified public concerns about taxpayer privacy, particularly following Elon Musk’s DOGE requests for IRS data access and a controversial IRS agreement to share immigrant tax information with ICE—an arrangement temporarily blocked by a November 2025 court ruling that remained under appeal. Treasury Secretary Scott Bessent framed the contract terminations as part of broader efforts to address waste and restore trust in government systems, announcing the decision on the opening day of the 2026 tax filing season.