IRS watchdog finds 52 employees accessed tax records of public figures in 86 cases
A Treasury Inspector General for Tax Administration (TIGTA) report released Tuesday, October 4, 2026, found that 52 Internal Revenue Service employees accessed the tax records of 30 public‑figure taxpayers in 86 suspicious instances between 2022 and 2025.
The findings raise serious concerns about the privacy of Americans’ financial information and the ability of the IRS to safeguard data that is essential to public trust in the tax system.
Investigators examined nearly six million system searches and identified a technical loophole in the IRS’s Integrated Data Retrieval System (IDRS). The “NAMES” search command allowed employees to retrieve identifying information using only a portion of a taxpayer’s last name, bypassing existing monitoring mechanisms.
Because the agency lacked systemic controls limiting employees to the accounts assigned to them, the unauthorized searches went undetected. TIGTA noted that the IRS had no preventive or monitoring controls specifically protecting the accounts of celebrities, elected officials or other high‑profile individuals.
Disciplinary outcomes were mixed. Of 53 confirmed unauthorized‑access cases from fiscal years 2023 through 2025, 31 employees were fired while 22 remained employed, although all 22 received some form of discipline. Decision‑makers cited length of service and first‑offense status as reasons for retaining those workers.
Notification failures compounded the issue. TIGTA reported that 276 taxpayers were never informed of the breach. In 175 cases, employees failed to follow notification procedures; in another 101 cases, the responsible staff resigned or retired before any disciplinary action could be proposed. The IRS later said it had notified 182 taxpayers, but some notices arrived more than 1,000 days after the unauthorized access.
The watchdog issued eight recommendations, including strengthening security controls, restricting access to sensitive database functions, and enforcing consistent, zero‑tolerance disciplinary policies. The IRS agreed or partially agreed with seven recommendations and plans to implement corrective measures by December 2026, while rejecting a recommendation to set explicit timeliness standards for victim notifications.
As the agency works to close the identified gaps, the report underscores the broader risk that inadequate data protection poses to taxpayer confidence and voluntary compliance with tax obligations.
