IRS: Cyber-thieves stole up to $39M