While critics express outrage over Elon Musk’s access to sensitive taxpayer data, the IRS is continuing to alert thousands of businesses and individuals that their tax information was leaked to a news organization that published dozens of articles on some of the hacked files.

Pro-Publica, funded in part by liberal donors including George Soros, has published nearly 50 stories on what it described as “a massive trove of taxpayer information” stolen by government contractor Charles E. Littlejohn and provided to the group.

A class-action lawsuit filed last month against the IRS and a government contractor revealed a much broader group of taxpayers may have been exposed in the leak, not just the ultra-wealthy.

Lawyers in the case believe the IRS notified, or is in the process of notifying, “hundreds of thousands of taxpayers” that their information was stolen or illegally accessed by Littlejohn between 2018 and 2020 and may have been handed over to ProPublica.

The leak to the publication is just one of several recent significant data breaches at the IRS as Mr. Musk, serving as the government efficiency adviser to President Trump, provoked outrage over plans to gain access to the agency.

Mr. Musk, seeking to eliminate waste, fraud and abuse, wants access to the IRS’s Integrated Data Retrieval System, which contains sensitive taxpayer information. The billionaire co-founder and leader of Tesla, SpaceX and other businesses, Mr. Musk has plans to modernize the antiquated IRS system by embedding U.S. DOGE Service software engineers at the agency.

Democratic lawmakers, unions and at least one taxpayer advocacy group have decried the DOGE dive into the IRS as illegal and a threat to privacy. DOGE will reportedly have no access to personal tax information.

A group of opponents is suing to stop DOGE from gaining access to the IRS.

“This case seeks to protect the privacy and the legal rights of millions of Americans, and thousands of small business owners, who depend upon the IRS,” the Center for Taxpayer Rights and a pair of unions representing government employees argued in court documents.

The fight over DOGE access comes as the IRS has struggled to prevent illegal hacks that have resulted in massive leaks of taxpayer data in recent years.

One the largest thefts of taxpayer data occurred in 2016, when hackers exploited weaknesses in an online IRS program that provides filers with previous tax returns. The hackers used the program to steal sensitive tax information from more than 300,000 individuals.

Years later, the Treasury Inspector General for Tax Administration continued to find weaknesses in IRS security protocols that exposed the agency to cyber thieves. In 2022, the inspector general found the IRS had not ensured that recommended minimum security countermeasures were put in place to stop security breaches.

In 2023, a Government Accountability Office report found “new and continuing control deficiencies” that increase the risk of “unauthorized access to, modification of and disclosure of sensitive data and programs, as well as the disruption of critical operations.”

Working at the IRS as a contractor for Booz Allen, Littlejohn uploaded thousands of taxpayer records between 2018 and 2020 and provided them in a USB drive to ProPublica.

The new organization has so far mined the stolen tax records for a lengthy series about ways the wealthy used the tax code to avoid paying “little in income tax compared to their massive wealth — sometimes, even nothing.”

Littlejohn pleaded guilty in October 2023 to unauthorized disclosure of tax returns and is serving a five-year sentence at a medium-security prison. He is celebrated by liberal groups who say his theft rightly exposed ways the wealthy use the tax code to pay less in taxes.

A GoFundMe page has raised $60,000 and several liberal groups lobbied unsuccessfully for Littlejohn to receive a pardon from President Biden. Littlejohn also leaked Mr. Trump’s tax records to The New York Times.

ProPublica won’t disclose the number of individuals or businesses whose stolen tax information it currently possesses.

In one statement to the Wall Street Journal, the publication described its trove as “extremely limited.” But officials with the news organization have also publicly described the haul as “massive” and “vast.”

The publication also declined to say whether it would publish additional articles exposing the tax information of individuals and businesses.

“In the essay published alongside the first article in the Secret IRS Files series, ProPublica’s editor-in-chief, Stephen Engelberg, and then-president, Dick Tofel, explained that after careful deliberation, ProPublica published select, newsworthy tax details of some of the richest Americans to inform the debate about the fairness of our tax system. These stories clearly served the public interest and we continue to stand by them,” a ProPublica spokeswoman said.

Articles written so far have revealed the private tax information of “America’s top 15 earners,” including Mr. Musk, Amazon founder Jeff Bezos, investor Warren Buffet and Citadel CEO Ken Griffin. ProPublica revealed additional “data” for the top 400 earners, including former Education Secretary Betsy DeVos, who served in Mr. Trump’s first term and ranks 389th on the ProPublica earners list.

The news outlet reported the earnings and tax rates of ProPublica funders, including Laurene Powell-Jobs, and revealed the earnings and tax rates paid by pop star Taylor Swift and basketball star LeBron James.

Less-prominent taxpayers are wondering whether their private data will be exposed next.

In January, Dallas-based Alarm Concepts Inc., a security equipment firm, sued the IRS and Booz Allen, the IRS contractor that employed Littlejohn, over the breach.

The IRS notified Alarm Concepts last Dec. 16 that Littlejohn, in the leak to ProPublica, had disclosed the company’s tax information, including tax forms, Social Security numbers and other sensitive information.

Lawyers representing the company said the government has acknowledged the continuing harm to those whose data was leaked to the news outlet.

“ProPublica has continued to publish stories using the disclosed data, even after Littlejohn entered a guilty plea. Alarm Concepts and other victims whose information has been disclosed to a news organization rightly fear that their private, confidential tax information could surface in the news at any time or could be disclosed to other news organizations,” the lawsuit alleges.

In court documents from a civil lawsuit brought by Mr. Griffin against the IRS, Littlejohn was asked to quantify how many people were snared in his data leak to ProPublica.

Littlejohn said his “guesstimate” of the “upper limit” of his data theft included 7,500 taxpayers over a 16-year span of tax filings.

In April 2024, however, the IRS began sending letters to more than 70,000 individuals and businesses warning that their tax information was included in Littlejohn’s data theft, according to the Alarm Concepts lawsuit. The IRS sent another round of letters to additional taxpayers in December. The IRS indicated last May it is still working to “fully understand” the scope of Littlejohn’s unlawful access to and disclosure of tax information.

After Littlejohn provided the stolen data to ProPublica, he said he helped reporters come up with story ideas, suggesting they use the Forbes list of the nation’s wealthiest Americans and publish what those top earners paid in taxes.

Littlejohn said he was assured by the reporters they would “keep a tight circle,” around who would have access to the data.

A ProPublica spokeswoman confirmed a book is in the works by some of the reporters who wrote the series that used the stolen tax information.

“The forthcoming book, which will be a popular history of U.S. efforts to tax the rich, is not a ProPublica project and does not involve ProPublica materials, including material from the IRS trove,” a spokeswoman said.

• Stephen Dinan contributed to this story.