Littlejohn's crime is the largest known data theft in IRS history. He did it while working for the IRS in 2020, using his access to the IRS's computer systems to file documents attached to thousands of America's wealthiest individuals and their tax returns. Illegally copied a tax return (and documents attached to that tax return) filed by a corporation. interest. Once Littlejohn had these returns, he sent them to ProPublica, an online nonprofit newsroom, and he published more than 50 articles using the data.
Under federal law, the IRS was required to notify each taxpayer affected by a data breach “as soon as practicable.” However, the IRS did not send notifications to affected taxpayers until April 12, 2024. It has been more than four years since the data breach occurred and months since Littlejohn's sentencing hearing.
I take action
If you receive a letter (Letter 6613-A) from the IRS with a copy of the criminal complaint against Littlejohn, that means you are the victim of his illegal activity. To protect yourself from this unprecedented breach of public trust, we recommend the following actions:
- Consider applying for an ID protection PIN. Common crimes that follow data theft include using taxpayers' Social Security numbers to file fraudulent tax returns seeking large refunds. Identity Protection PIN (IP PIN) helps protect you from this scheme. Once you have an IP PIN, criminals cannot file income tax returns in your name without knowing your identification number, which changes every year. Learn more and apply for your IP PIN here.
- Request and confirm your tax return. The IRS maintains records of all tax-related matters, including filings, payments, refunds, extensions, and official notices. Check your tax return regularly (for example, every 6 to 12 months) to expose fraud while there is still time to take corrective action. Request a copy of your tax return here. If you have any questions about your transcript or need help obtaining your transcript, we are ready to help.
- Get identity protection monitoring services. Applying for an IP PIN and checking your tax records regularly can help protect you from tax fraud, but it won't protect you from other criminal activity, such as fraudulent loan applications. To protect yourself from these other risks, you should obtain her identity protection monitoring services from a trusted provider.
- Evaluate legal action. Victims of data breaches should consider taking legal action against Littlejohn, the IRS, and anyone else complicit in his wrongdoing. Understandably, most victims will not want the cost, aggravation, and public attention of litigation, but litigation is an option for those concerned about the integrity of the public tax system.
In fact, a lawsuit against the IRS is already underway. On December 13, 2022, Citadel founder and CEO Kenneth Griffin discovered that his personal tax information had been illegally disclosed to ProPublica and filed a lawsuit against the IRS in the U.S. District Court for the Southern District of Florida. filed a lawsuit against. In his complaint, Griffin argues that despite repeated warnings from the Treasury Department's Inspector General and the U.S. Government Accountability Office that the IRS' existing systems are completely inadequate, The lawsuit alleges that the company intentionally failed to establish adequate safeguards. Griffin is seeking an order directing the IRS to “develop, adopt, and implement a data security plan” to protect taxpayer information.
The future of Mr. Griffin's case is unclear. Recently, the judge in his case rejected one of his two claims, casting doubt on the theory supporting the remaining claims. It could take years before a final decision is made.
Mr. Griffin is leading the way, and joining this fight will strengthen his efforts and further his goal of ensuring the integrity of our nation's tax system. The final order in Mr. Griffin's case will be appealed to the U.S. Court of Appeals for the Eleventh Circuit. The decision there would be binding on both the IRS and taxpayers living in Alabama, Florida, and Georgia. However, the IRS may also be bound by orders issued by other federal courts based on lawsuits brought by taxpayers living elsewhere. Because other courts may disagree with the Eleventh Circuit's opinion, if the Griffin case is not successful, a taxpayer living in another state could potentially file his own suit against the IRS. there is.
If you are a victim of an IRS data breach and are interested in taking legal action, you should act now. Under the Internal Revenue Code, from the date a taxpayer discovers a data breach, he must file a lawsuit within two years.