Earlier this year, the IRS confirmed that over 400,000 taxpayers were victims of IRS contractor Charles Littlejohn’s 2019 leak of taxpayer data, which is discussed here. Littlejohn stole IRS data that included taxpayers’ personal identifying information and leaked tax returns, including those of President Trump, to prominent news sources. The IRS had stated last April that it expected to notify approximately 70,000 affected entities and individuals. The IRS’ newest revelation marks a dramatic leap in the number of affected taxpayers.

Despite the hurdles associated with seeking meaningful compensation, as statutory damages are generally capped at $1,000, some taxpayers have forged ahead with actions against the IRS and Littlejohn’s former employer, Booz Allen Hamilton (“Booz Allen”).  In an effort to increase their recovery, some taxpayers have creatively added other uncapped claims. For example, in one ongoing lawsuit, an affected taxpayer successfully pleaded for statutory damages and invasion of privacy. However, the U.S. District Court for the District of Maryland rejected the taxpayer’s claim for negligent supervision. In addition, a Texas company recently filed a class action lawsuit against the IRS and Booz Allen in the District of Maryland for statutory damages and substantial punitive damages, alleging that both defendants failed to establish appropriate safeguards to protect confidential taxpayer data.

Although the IRS has stated that the vast majority of affected taxpayers have been notified, it appears that the impact of Littlejohn’s actions will remain with the IRS for some time, and could be costly. Taxpayers receiving notices should consult their tax advisors to understand the potential impact and next steps.