Storage device manufacturer Seagate’s executives informed employees last week that their income tax data had been shared with an unknown outside party as the result of a targeted phishing attack. On March 1, a Seagate employee sent the data to an outside e-mail address after receiving an e-mail purportedly from Seagate’s CEO Stephen Luczo requesting 2015 W-2 data for current and former Seagate employees. The employee, believing the request to be real, forwarded the W-2 reporting data—exposing US employees of Seagate to potential tax fraud and identity theft.
Security reporter Brian Krebs reported the breach after learning of it from a Seagate employee who had been given written notification of the breach. The Seagate breach comes less than a week afterSnapchat employees’ data was leaked in the same way. Last week, the New York Post broke newsthat Mansueto Ventures (the publishers of Inc. Magazine and Fast Company) also had payroll data stolen.
Seagate’s spokesperson Eric DeRitis confirmed the incident to Krebs. “On March 1, Seagate Technology learned that the 2015 W-2 tax form information for current and former US-based employees was sent to an unauthorized third party in response to the phishing e-mail scam,” DeRitis said. “The information was sent by an employee who believed the phishing e-mail was a legitimate internal company request.” DeRitis told Krebs that “several thousand” employees were affected and that the company is working with federal law enforcement; employees will receive two years of credit protection from the company.
Credit protection won’t help that much, however, as in both cases, it’s likely that the phishing attack came from criminals planning to use the data to file fraudulent tax returns. In February, the IRS reported that IRS.gov electronic tax filing credentials for 101,000 social security numbers were stolenfrom a contractor’s systems. Last year, criminals using stolen personal identifying information from commercial data breaches obtained access to tax data for over 300,000 taxpayers from IRS’ tax record system. It is believed that the attack came from Nigeria.
Krebs reported on a fraudulent tax return case last March in which a woman aided fraudsters by cashing a check in the US and wiring the proceeds to Nigeria.
SOURCE: Sean Gallagher | Ars Technica