Treasury Cuts Ties With Booz Allen Over IRS Data Leaks

The U.S. Department of Treasury said it canceled all active contracts with federal contracting mainstay Booz Allen Hamilton, citing data protection failures tied to the handling of taxpayer information.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Treasury Secretary Scott Bessent said Monday the firm “failed to implement adequate safeguards to protect sensitive data” including “confidential taxpayer information it had access to through its contracts with the Internal Revenue Service.”

The department holds 31 separate contracts with Booz Allen Hamilton, representing roughly $4.8 million in annual spending and approximately $21 million in total obligations, according to a Treasury department press release. Bessent said the move aligns with President Donald Trump’s directive to aggressively eliminate waste, fraud and abuse across federal agencies.

Treasury cited a criminal case against Charles Littlejohn, a former Booz Allen employee who leaked the tax returns of President Donald Trump and mercurial centibillionaire Elon Musk, among others.

Littlejohn received a five year prison sentence in January 2024 after pleading guilty to one count of disclosing tax return information without authorization. In a plea bargain statement, Littlejohn acknowledged accessing 15 years’ worth of tax returns filed by thousands of the wealthiest Americans and uploading the data to a private website.

One recipient of that data was ProPublica, which reported in 2021 that billionaires including Jeff Bezos, Michael Bloomberg and Musk often avoided paying any federal taxes.

New York Times reporting in 2020 enabled by a Littlejohn leak found Trump paid no income taxes in 10 of the previous 15 years. Trump in 2016 and in subsequent elections broke with precedent established after the Watergate scandal of presidential candidates releasing returns to the public. The House Ways and Means Committee in 2022 published six years’ worth of Trumps’ tax returns.

The IRS in early 2025 concluded that Littlejohn disclosed data pertaining to 405,000 taxpaying entities, the majority of them corporations. It earlier said it was unable to fully investigate the extent of the breach until after Littlejohn’s guilty plea – and that it saw no evidence that other organizations besides The New York Times and ProPublica obtained the data.

Littlejohn took steps to avoid detection, including by not directly querying the IRS database for Trump’s tax returns. He instead used more general search terms that would include the returns. He also used virtual machines on his IRS laptop, deleting minutes after stealing a data set and another two days later. Prosecutors said he evaded IRS protocols for detecting large data exfiltration by saving tax returns to multiple personal storage devices, including an iPod.

Shortly after uploading tax return data to his private website, he contacted the domain registrar to cancel it (see: How An Ex-IRS Contractor Covertly Leaked Trump’s Tax Returns).

Booz Allen has played a key role in federal technology modernization efforts for decades. Treasury did not indicate in its announcement whether the canceled work will be re-competed or assigned internally to divisions across the agency.

Booz Allen Hamilton and the Treasury Department did not immediately respond to requests for comment.