The United States Internal Revenue Service (IRS) has exposed confidential information of approximately 120,000 individuals by accidentally posting the information to its website. The IRS confirmed in a post on Friday that machine-readable (XML) Form 990-T data was made available for bulk download on the Tax Exempt Organization Search (TEOS) page that should not have been publicly available. Form 990-T is the “business tax return used by tax-exempt entities, including tax-exempt organizations, government entities and retirement accounts, to report and pay income tax” on unrelated business income, which is commonly derived from “sales unrelated to the nonprofit’s core purpose or real estate investments that pay income to an individual retirement account.” For 501(c)(3) organizations (otherwise known as non-profit entities such as charities, etc.), a Form 990-T must be available for three (3) years for public inspection. Notably, some of the information posted was for a subset of non-503(c)(3) organizations which is “not subject to public disclosure.” The exposed data in this breach includes names, contact information, and financial information about income within the exposed 990-T forms. The IRS confirmed that the exposed data does not contain Social Security numbers (SSNs), detailed account-holder information, or individual income tax returns (Forms 1040). The Wall Street Journal reported that this incident was due to a human coding error that occurred last year when Form 990-T began to be filed electronically. Notification letters are being sent to impacted individuals within the next coming weeks, and the IRS confirmed that the data has been removed from its website. CTIX analysts will continue to monitor this incident and provide updates as needed.