Inland Revenue says personal IRD numbers are included in emails incorrectly sent out last week.
It says hundreds of people could have had their privacy breached in the incident in which 201 emails were incorrectly sent to 69 people on Friday.
The department still doesn't know what was in each of the emails, but said some included confidential information such as people's IRD numbers.
It was still unclear how many people had their details sent out.
IRD acting deputy commissioner Mike Hewetson said on Monday that 30 to 40 people were working on the incident and contacting everyone who may be affected.
Some 22,000 emails were held over the weekend while IRD checked its mail server, but the department's email is operating again.
The IRD said the email malfunction was the result of software corruption, where the 'to' and 'from' address lines for a group of emails were scrambled. It said the problem had been fixed and would not happen again.
The IRD apologised to those people whose privacy had been breached, along with those who incorrectly received the emails.
Mr Hewetson said there was no evidence the problem was the result of a malicious attack but the department was undertaking an investigation to make sure other computer systems hadn't been affected.
Inland Revenue Minister Peter Dunne said he was happy with the department's reaction to the problem, which included notifying the Privacy Commissioner, and people could continue to have confidence in the IRD.
In October last year, Inland Revenue revealed it had sent the personal information of more than 6000 people to the wrong recipients, including more than 600 people who were at risk of having their identity stolen.