IRS exposed about 120K people's information online

The Internal Revenue Service mistakenly posted information from approximately 120,000 individuals on its website before discovering the error on Aug. 26 and taking it down.

The information came from the Form 990-T, the business tax returns filed by tax-exempt organizations. 

"The IRS recently discovered that some machine-readable (XML) Form 990-T data made available for bulk download section on the Tax Exempt Organization Search (TEOS) should not have been made public," the IRS said in a statement Friday. "This section is primarily used by those with the ability to use machine-readable data; other more widely used sections of TEOS are unaffected."

A man walks past the IRS headquarters in Washington, D.C.
The IRS headquarters in Washington, D.C.

The IRS blamed a coding error and said it took immediate steps to address the issue, removing the files from IRS.gov and with plans to replace them with updated files in the near future. However, reporters with The Wall Street Journal said they were able to download the data before it was removed and it included information from about 120,000 individuals.

The IRS said it will be working with groups that routinely use the files to remove the erroneous files and replace them with the correct versions as they become available, and it will contact all of the affected filers in the weeks ahead.

The Form 990-T is filed by various types of tax-exempt organizations, including government entities and retirement accounts, to report and pay income taxes on the money generated from their investments as well as income unrelated to their exempt purpose.

The IRS noted that it's required to publicly disclose the information for Section 501(c)(3) organizations, but the information that was inadvertently posted isn't supposed to be subject to public disclosure. 

The data it posted doesn't include Social Security numbers, detailed account-holder information or individual income tax returns such as the Form 1040 series. But in some instances, the data does include individual names or business contact information, the IRS acknowledged. It said it's continuing to review the situation.

The Wall Street Journal noted that the information disclosed from the Form 990-T was mainly about IRAs, including names, contact information and financial information about income within the IRAs, especially from investments in master limited partnerships, real estate or other assets that generate income as opposed to IRAs that invested in securities.

For reprint and licensing requests for this article, click here.
Tax IRS Tax returns Tax exemptions Cyber security
MORE FROM ACCOUNTING TODAY