The security beach happened as the result of a "spear phishing" email scam, spokeswoman Sophie Jefferies said in a statement.
Every employee has been notified and given guidance on how to respond, she said, adding that the organization has also established a hotline dedicated to answering employees' questions about the breach.
"We have alerted the IRS, California Attorney General and law enforcement, and we will fully cooperate with any investigation," Jefferies said.