A Treasury watchdog found dozens of IRS employees made suspicious searches involving prominent taxpayers while identifying broader weaknesses in safeguards, disciplinary practices and notification procedures for people whose confidential records were accessed without authorization.
By yourNEWS Media Newsroom.
The Internal Revenue Service lacks adequate controls to prevent employees from improperly browsing confidential taxpayer information, according to a newly released federal audit that identified 86 suspicious accesses involving 30 taxpayers and 52 IRS employees.
The Treasury Inspector General for Tax Administration said in its Sept. 29 audit report that investigators examined IRS system activity from calendar years 2022 through 2025, using records available as of November 2025. The accounts flagged in the review belonged to people described by the watchdog as “United States government officials, business leaders, and entertainers.”
READ THE FULL REPORT: 2026300058fr
“The IRS’s UNAX [unauthorized access] program is not adequately addressing the risk of unauthorized access to taxpayers’ accounts,” TIGTA said.
The inspector general said the problems extended beyond the suspicious account searches themselves, finding weaknesses in preventive safeguards, employee discipline and procedures for informing taxpayers when IRS personnel improperly inspect their information. The report cited “deficiencies” in the “controls and/or processes intended to protect taxpayers and hold employees accountable for their actions.”
IRS employees routinely require access to confidential taxpayer information to perform legitimate tax-administration duties, but federal law generally prohibits them from examining taxpayer records without an authorized business purpose. The agency’s Unauthorized Access, Attempted Access or Inspection of Taxpayer Records program, commonly known as UNAX, is intended to prevent, identify and address such conduct.
TIGTA’s examination found that existing safeguards were not sufficient to systematically prevent or detect employees who browse the accounts of celebrities and other prominent people. The 86 suspicious accesses identified by auditors were referred to TIGTA’s Office of Investigations for further action.
The watchdog separately examined how the IRS disciplined employees in substantiated unauthorized-access cases and found significant differences in outcomes. TIGTA “identified 22 employees who were not terminated” despite having accessed taxpayer information “without the taxpayer’s consent or the IRS’s authorization.”
The findings raise questions about how the agency applies its stated disciplinary standards when employees intentionally inspect records they have no legitimate tax-related reason to view. IRS disciplinary procedures allow management to consider factors surrounding individual cases, but TIGTA concluded that the handling of some cases may undermine the agency’s stated zero-tolerance approach toward unauthorized browsing.
Taxpayer notification procedures were another major focus of the review. TIGTA found that the IRS “failed to notify 175 taxpayers that their records were accessed by an unauthorized IRS employee because employees did not follow procedures.” The agency agreed those taxpayers should have received notice.
Another 101 taxpayers did not receive notification because the employees responsible for the unauthorized access “either resigned or retired before disciplinary action was proposed.” Under the process examined by TIGTA, notification requirements were tied in part to disciplinary proceedings, creating a gap when an employee departed the agency before proposed discipline could occur.
Auditors also concluded that taxpayers who were notified were not always told promptly. The report found deficiencies in the timing of notices and said delays can leave affected taxpayers unaware that an IRS employee improperly examined their confidential information.
TIGTA issued eight recommendations intended to strengthen the UNAX program. Among them were proposals for the IRS to study technological and systemic changes capable of preventing unauthorized access, reduce or more closely control the number of employees able to use certain taxpayer-search functions, strengthen monitoring of suspicious activity and reinforce guidance concerning the consequences of intentional violations.
The watchdog also called for changes intended to ensure taxpayers are notified when a confirmed unauthorized access occurs, including situations in which an IRS employee retires or resigns before disciplinary proceedings are initiated. TIGTA additionally recommended stronger executive oversight and improved measurements for evaluating whether the program is preventing improper access and responding effectively when violations occur.
Acting IRS Chief Privacy Officer John J. Walker responded to the draft findings in a Sept. 16 memorandum, saying the agency remained committed to protecting taxpayer information and strengthening its unauthorized-access controls. IRS management “agreed” or “partially agreed” with seven of TIGTA’s eight recommendations, with corrective actions planned or already underway.
Some of those actions are scheduled for December 2026, while other system-related changes extend into 2027. The IRS agreed to clarify employee-discipline guidance, examine whether existing law allows broader notification of taxpayers affected by confirmed unauthorized access and improve performance measurements for the UNAX program.
The agency disagreed with TIGTA’s recommendation to “establish overall timeliness standards regarding victim notifications to impacted taxpayers,” maintaining that standards already exist governing the period between receipt of investigative reports and notification of affected taxpayers.
TIGTA disagreed with that assessment, finding that existing procedures did not provide a sufficiently comprehensive standard for all unauthorized-access situations. The watchdog concluded that the IRS’s notification system needed broader and more consistent requirements to ensure affected taxpayers learn about improper access within an appropriate period.
The audit arrives amid heightened scrutiny of the government’s handling of confidential tax information and follows litigation brought by President Donald Trump and the Trump Organization over an earlier leak of protected records.
Trump voluntarily dropped a $10 billion lawsuit against the IRS and Treasury Department in May 2026 after pursuing an alternative proposal for an “anti-weaponization fund,” which was subsequently abandoned. Trump and the Trump Organization had alleged in the January lawsuit that federal authorities failed to adequately protect confidential tax information from unauthorized inspection and disclosure in 2019, causing financial and reputational harm.
That dispute followed the prosecution of former IRS contractor Charles Littlejohn, whose unauthorized acquisition and disclosure of confidential tax records became one of the most prominent recent breaches involving federal taxpayer data. Littlejohn was sentenced in January 2024 to five years in federal prison after pleading guilty to unlawfully disclosing tax return information involving Trump and thousands of other taxpayers to news organizations, including The New York Times and ProPublica.
The latest TIGTA findings concern a broader internal-control problem: whether IRS systems can effectively stop employees with legitimate system credentials from using that access for unauthorized purposes. The inspector general concluded that the agency’s existing safeguards, disciplinary procedures and victim-notification practices require additional changes to more effectively protect confidential taxpayer records.
Original article
Comments