The IRS illegally shared the taxpayer information of thousands of people with the Department of Homeland Security, violating federal privacy laws designed to keep tax records confidential, according to a court filing made public Wednesday.

The breach happened under a controversial data-sharing agreement signed last April between Treasury Secretary Scott Bessent and Homeland Security Secretary Kristi Noem. The deal lets ICE submit names and addresses of immigrants to the IRS for cross-verification against tax records—part of Trump’s deportation machine.

Here’s how badly they botched it: ICE requested information on 1.28 million people. The IRS could only verify about 47,000 of those names. But for roughly 5% of those individuals, the agency handed over additional address information without proper verification—a clear violation of taxpayer privacy rules.

IRS Chief Risk and Control Officer Dottie Romo admitted in the court filing that Treasury notified DHS of the error in January and asked the agency to dispose of the improperly obtained data. Whether DHS has actually deleted anything remains unclear.

The data-sharing scheme has been a legal disaster from the start. Public Citizen sued the Treasury and Homeland Security secretaries on behalf of immigrant rights groups shortly after the agreement was signed. A Massachusetts federal court ordered the IRS to stop sharing residential addresses with ICE. Last November, a federal court blocked the information sharing entirely, ruling the IRS had illegally disseminated migrant tax data.

The administration kept doing it anyway.

“This breach of confidential information was part of the reason we filed our lawsuit in the first place,” said Lisa Gilbert, co-president of Public Citizen. “Sharing this private taxpayer data creates chaos and, as we’ve seen this past year, if federal agents use this private information to track down individuals, it can endanger lives.”

Tom Bowman, policy counsel for the Center for Democracy & Technology, noted that improper sharing of taxpayer data is subject to criminal penalties. “Once taxpayer data is opened to immigration enforcement, mistakes are inevitable and the consequences fall on innocent people,” he said.

The IRS did not respond to a request for comment.