It’s not just companies like Sony Pictures Entertainment that are facing lawsuits for failing to do enough to protect personal information from hackers.
Two taxpayers filed a suit seeking class action status against the Internal Revenue Service on Thursday in response to a massive data breach impacting hundreds of thousands of people. Hackers reportedly stole personal data including Social Security numbers and accessed completed tax returns.
The hackers were then able to use the information to file for bogus tax refunds, resulting in criminals obtaining $50 million in federal funds. Although the IRS originally said that the data breach affected 104,000 people, it revised that number this week to 330,000 people.
The lawsuit alleges that the IRS knew its website was vulnerable to security breaches, but did nothing to address the problems.
“As custodians of taxpayer information, the IRS has failed in its obligation to protect the personal and sensitive information of hundreds of thousands of taxpayers, their spouses and families,” Richard McCune, a lawyer representing the plaintiffs, said in a statement.
The lawsuit did not mention the amount of damages sought.
The IRS declined to comment on the lawsuit to Bloomberg News, but sent a statement saying that it is notifying taxpayers who may have been impacted by the breach.
Fortune reached out to the IRS for comment and will update this story if we hear back.
Subscribe to Data Sheet, Fortune’s daily newsletter on the business of technology.
For more on data breaches, check out the following Fortune video: