SAN FRANCISCO — Tax-filing season is turning into a nightmare for thousands of employees whose companies have been duped by e-mail fraudsters.
A major phishing scheme has tricked several major companies — among them, the messaging service Snapchat and disk-drive maker Seagate Technology — into relinquishing tax documents that exposed their workers’ incomes, addresses and Social Security numbers.
The scam, which involved fake e-mails purportedly sent by top company officials, convinced the companies involved to send out W-2 tax forms that are ideal for identity theft. For instance, W-2 data can be used easily to file bogus tax returns.
The breakdowns have prompted employers to apologize and offer free credit monitoring to employees. Such measures, however, won’t necessarily shield unwitting victims from the headaches that typically follow identity theft.
“This mistake was caused by human error and lack of vigilance and could have been prevented,” Seagate’s chief financial officer, Dave Morton, wrote in a March 4 e-mail to the company’s employees about the breach.
Seagate acknowledged surrendering the W-2s for all of its current and former employees who worked at the company last year. The Cupertino, Calif., company said “several thousand” people were affected but declined to be more precise.
As of July last year, Seagate employed more than 10,000 workers in the U.S., 1,400 of those in Longmont.
The swindlers behind the tax scam are exploiting human gullibility rather than weaknesses in computer or Internet security. They have targeted company payroll and personnel departments, in many instances with e-mails claiming to be requests from the company CEO asking for copies of worker W-2s.
The schemes are so widespread that the IRS sent a notice alerting employers’ payroll departments of the spoofing e-mails.
