Just before Labor Day, the IRS announced its discovery that confidential Form 990-T filings of roughly 120,000 individuals had been inadvertently posted for bulk download by the public. While the agency did not specify how long this data was compromised, media reports suggest a coding error may have made the private information available for months. 

Tax-exempt entities use Form 990-T to report taxable business or investment income unrelated to their exempt purposes. The IRS publicly discloses such filings by 501(c)(3) nonprofits.

The Treasury Department reported the mistaken publication of non-501(c)(3) data in a letter to Congress required by federal law within seven days of discovering such a major breach. It said Social Security numbers, income or financial account details, and “other sensitive information that could impact a taxpayer’s credit” were not compromised. But names and contact information were available in at least some cases.

According to the letter, the IRS immediately took steps to remove the data and is working to correct the mistake with groups that routinely access and utilize such public files on its Tax Exempt Organization Search (TEOS) platform. The agency also plans to contact the approximately 120,000 taxpayers affected by these disclosures.

Treasury official Anna Canfield Roth indicated the IRS has been instructed: “to conduct a prompt review of its practices to ensure necessary protections are in place to prevent unauthorized data disclosures.” She promised additional details about their response in this case within 30 days.

Coming on the heels of the Inflations Reduction Act’s $80 billion funding boost for the IRS — particularly its hotly debated focus on increased enforcement — as well concerns over document destruction and a yet-to-be explained leak of tax filings to ProPublica last year, this mistake may have ongoing repercussions in the nation’s capital.