I doubt that the IRS cares if someone's personal info is stolen from their site. The Feds don't seem to care much about identity theft due to the Feds causing the problem. They will gladly set you up to be notified when you are screwed for a year or two.
I'm laughing that the buyer has their panties in a bunch over this. The seller would have more to worry about if for some reason there was no "proof" that they'd sold it if the buyer either lost the gun or used it in a crime. Transaction number should be adequate.