The sites sending the sensitive data were operated by major tax preparation services including H&R Block, TaxAct, and TaxSlayer.