Booz Allen is a government and military consulting company that provides management, technology and engineering services to public and private sector organizations and nonprofits. (Photo by Kevin Dietsch/Getty Images)
Getty Images
The Treasury Department announced it is canceling all contracts with Booz Allen Hamilton (often simply called Booz Allen) for failing to protect sensitive taxpayer information. Treasury cited the massive IRS data breach carried out by former Booz Allen employee Charles Edward Littlejohn. The department said it is terminating 31 contracts, totaling about $4.8 million in annual spending and roughly $21 million in total obligations.
Treasury Secretary Scott Bessent framed the move as part of the administration’s effort to root out waste, fraud, and abuse and to restore public trust in government, saying Booz Allen failed to implement adequate safeguards for confidential taxpayer data accessed through IRS work.
Charles Littlejohn
The breach referenced by Treasury is considered among the most serious in U.S. history. Littlejohn, a former IRS contractor employed by Booz Allen, stole and disclosed tax returns and return information, including Donald Trump’s, between 2018 and 2020. According to prosecutors, Littlejohn viewed Trump as “dangerous and a threat to democracy” and intended to release private tax information to the public.
Littlejohn initially disclosed Trump’s tax information to the New York Times. According to court records in Littlejohn’s criminal case, he turned over returns and return information dating back more than 15 years for billionaires Elon Musk, Jeff Bezos, Warren Buffett, and Michael Bloomberg to ProPublica. The data included not only tax returns but also investment details, stock trades, gambling winnings, audit determinations, and other financial information. But it wasn’t only those wealthy individuals who were impacted—it appears that some taxpayers who were shareholders in passthrough entities were also affected (in other words, their information appeared on Forms K-1 or the equivalent from passthrough entities that had their information leaked).
Littlejohn accessed the returns in an IRS database using broad search parameters designed to conceal the true purpose of his queries. He then evaded IRS protocols designed to detect and prevent large downloads or uploads from IRS devices or systems, and he saved the tax returns to multiple personal storage devices, including an iPod.
In October 2023, Littlejohn pleaded guilty to unauthorized disclosure of tax returns and return information—a violation of section 7213(a)(1) of the tax code, the most serious offense for leaking tax information. He was sentenced to the maximum penalty of five years and is currently serving his sentence in a Florida prison.
Scope of the Breach
The scope of the breach proved far larger than initially understood. According to IRS disclosures, approximately 405,000 to 406,000 taxpayers were affected, with the vast majority being business entities. The leaked material included not only full tax returns but also highly sensitive financial details such as investment activity, audit determinations, and information related to passthrough entities, meaning that taxpayers whose names were never publicly reported were nevertheless swept into the breach.
Beginning in late 2023 and continuing into 2024, the IRS mailed legally required notification letters to affected taxpayers and later acknowledged the breach to Congress.
The fallout included a rare public apology from the IRS to some of the victims, including wealthy taxpayers whose information was disclosed to journalists. The agency conceded that confidential data had been improperly accessed and shared and emphasized that the disclosures violated strict federal laws governing tax return confidentiality.
Some victims initially filed claims against the IRS, but those efforts were limited because Littlejohn was a contractor rather than a government employee. Other lawsuits instead targeted Booz Allen, alleging that the firm failed to properly monitor employee access to IRS systems and to protect taxpayer data. Booz Allen has consistently characterized Littlejohn’s conduct as that of a rogue actor who concealed his misconduct within government systems.
Treasury’s move to sever all remaining ties with Booz Allen comes on the opening day of the 2026 tax filing season, and that’s likely no coincidence. Taxpayers have raised concerns about taxpayer privacy and data sharing since the breach, heightened by Musk’s Department of Government Efficiency (DOGE) requests to access sensitive taxpayer data at the IRS and by the IRS’s subsequent agreement to share immigrant tax data with Immigration and Customs Enforcement (ICE).
(A November 2025 federal court ruling blocking the agreement was appealed this month.)
Booz Allen Response
Booz Allen, a management and technology consulting firm headquartered in McLean, Virginia, has a long history of working with US civilian and defense agencies, including the IRS, resulting in billions of dollars in government-funded contracts. The company employs about 36,000 people.
In a response to a request for comment, Booz Allen issued the following statement to Forbes, attributable to a company spokesperson:
“We have consistently condemned in the strongest possible terms the actions of Charles Littlejohn, who was active with the company years ago. Booz Allen has zero tolerance for violations of the law and operates under the highest ethical and professional guidelines. When Littlejohn’s criminal conduct occurred more than five years ago, it was on government systems, not Booz Allen systems. Booz Allen stores no taxpayer data on its systems and has no ability to monitor activity on government networks.
Booz Allen fully supported the U.S. government in its investigation, and the government expressed gratitude for our assistance, which led to Littlejohn’s prosecution. We were surprised by this announcement and look forward to discussing this matter with Treasury.”
Read the full article here