Data-storage firm Seagate Technology confirmed that it recently became the latest victim of a phishing scam that exposed tax information of its workers to digital thieves.
The company said in a statement that a Seagate employee was tricked into sending 2015 W-2 tax documents for current and former U.S. employees after receiving a phishing email — a type of nefarious digital inquiry that seeks to entice the recipient into providing access to sensitive data without realizing it.
Others recently hit by similar tax-phishing scams include social-media firm Snapchat, which apologized after certain payroll information was exposed, and The Evening Post Industries.
Phishing scams have become a serious threat to individuals and corporations, with hackers posing as friends or business contacts to gain access to lucrative or damaging information.
The Internal Revenue Services issued a public alert on March 1 about phishing schemes in which the perpetrator is posing as a company executive and requesting employees’ personal information. The agency said it has noticed a 400% increase in tax-phishing scams this tax season.
“This is a new twist on an old scheme using the cover of the tax season and W-2 filings to try tricking people into sharing personal data. Now the criminals are focusing their schemes on company payroll departments,” IRS Commissioner John Koskinen said in a statement. “If your CEO appears to be emailing you for a list of company employees, check it out before you respond. Everyone has a responsibility to remain diligent about confirming the identity of people requesting personal information about employees.”
Seagate said it learned of its breach on March 1. “The information was sent by an employee who believed the phishing email was a legitimate internal company request,” Seagate said. “When we learned of the incident, we immediately notified the IRS which is now actively investigating it along with federal law enforcement.”
In Snapchat’s case, user information was not released. But Snapchat admitted that a phishing email posing as the company’s CEO led to the breach in which “a number of our employees have now had their identity compromised.”
At Seagate, information associated with several thousand workers was exposed, according to industry publication KrebsOnSecurity.
The Internal Revenue Service has flagged the tax information of the affected employees to watch out for fraudulent tax returns, Seagate said.
“At this point we have no information to suggest that employee data has been misused, but caution and vigilance are in order,” Seagate said. “We deeply regret this mistake and we offer our sincerest apologies to everyone affected. Seagate is aggressively analyzing where process changes are needed and we will implement those changes as quickly as we can.”
The company said it is offering a free two-year subscription to an identify-theft monitoring service to its employees.
Follow USA TODAY reporter Nathan Bomey on Twitter @NathanBomey.