The IRS has discovered more than 1 million Americans whose Social Security numbers were stolen by illegal immigrants, but officials never bothered to tell the taxpayers themselves, the agency’s inspector general said in a withering new report released Tuesday.

Investigators first alerted the IRS to the problem five years ago, but it’s still not fixed, the inspector general said, and a pilot program meant to test a solution was canceled — and fell woefully short anyway.

As a result, most taxpayers don’t learn that their identities have been stolen and their Social Security files may be screwed up.

PHOTOS: Top 10 handguns in the U.S.

“Taxpayers identified as victims of employment-related identity theft are not notified,” the inspector general said.

The report alarmed lawmakers on Capitol Hill, who were shocked that the IRS had gone for so long without fixing the issue.

“It is stunning that the IRS has chosen to aid and abet identity thieves for so long instead of protecting the innocent victims of the theft,” said Sen. Daniel Coats, Indiana Republican.

PHOTOS: Stars who support Trump

Victims’ numbers are stolen by illegal immigrants who need to give employers a valid Social Security number in order to get a job. Employers are prohibited from probing too deeply into numbers, even when they suspect fraud.

But the IRS learns of the scam when the illegal immigrants file their taxes using a special Individual Taxpayer Identification Number (ITIN) the agency doles out chiefly to illegal immigrants as a way of making sure they’re paying taxes even if they’re not supposed to be in the U.S.

Between 2011 and 2015 the agency flagged nearly 1.1 million returns where someone appeared to have stolen a valid Social Security number, the inspector general said.

The IRS did not have any new comment on the findings, instead referring reporters to an official response filed with the inspector general, in which the agency insisted it’s making progress.

Karen Schiller, commissioner for the IRS‘ small business and self-employed division, said the 2014 pilot program was helpful, even if it didn’t completely solve the notification problem, and said the agency will try to alert all taxpayers beginning next year.

“As we continue to battle and make progress against all strains of identity theft in the tax ecosystem, we recognized that we were missing an important partner in this effort — the taxpaying public,” said Ms. Schiller, who had the task of answering the inspector general.

She also vowed to figure out a system to let the Social Security Administration (SSA) know if someone’s number has been stolen.

Under the 2014 pilot program, the IRS did notify some 25,000 taxpayers whose SSNs were pilfered. The notice they received told them to contact credit-monitoring agencies to try to head off any more damage to their personal finances.

But the IRS said it’s prevented by federal law from telling taxpayers who stole their identity.

The IRS says its role is not to enforce immigration laws but rather to collect taxes. The agency issues ITINs to ensure that unauthorized workers can still file tax returns, even if they aren’t supposed to be working in the U.S.

Taxpayers who use an ITIN are eligible for some tax credits, particularly for their children who are U.S. citizens.

Congressional Republicans have long complained to the IRS that it is protecting illegal immigrants from discovery by allowing the use of ITINs but failing to share the information with other agencies.

Mr. Coats, who has written legislation requiring victims to be notified, even confronted IRS officials about their lax behavior at a hearing in April.

“All of us can agree that victims need to know that they’re victims, and need to know that an agency of the federal government, whether it’s IRS or whether it’s SSA, or both, ought to have some ability to talk to each other,” Mr. Coats said.

IRS Commissioner John G. Koskinen told Mr. Coats at the hearing that in many of the cases, friends or relatives lent their Social Security numbers to the unauthorized workers, and already know their information is being fraudulently used.

He also said the agency struggled to come up with a solution that wouldn’t chase illegal immigrants away from filing their taxes altogether.

“Obviously, priority for taxpayers and the IRS is collecting those taxes,” he said.

Mr. Koskinen testified at the time that it may take new legislation from Congress to let his agency inform taxpayers they’d been the subject of identity theft.

But the hiccup in communicating with the Social Security Administration seems like it should be easier to solve. The inspector general, however, said the IRS didn’t have a system set up to make sure SSA always knew of the fraud.

In some cases IRS employees said they sent a notice, but the Social Security Administration had no record of it. In other cases, it appears the IRS didn’t even bother to make a notification.

“The lack of a formal process to ensure that the SSA is notified of income not associated with an innocent taxpayer is problematic because this notification is essential to ensure that victims’ Social Security benefits are not affected,” the inspector general said.