That'd be my guess.  I'd maybe start with a call to your stakeholder liaison at IRS.  They should be able to connect you directly with someone at IRS who can go over your client list and see if this is widespread.  If you have been hacked, they can also walk you through the notification process.