A technology firm with an office in Lehigh County is the latest business to be hit by an email scam that tricks an employee into divulging sensitive information, in this case employee W-2 records.
Weidenhammer, which has several locations in Pennsylvania including Hanover Township, discovered the phishing attack Thursday, company President John P. Weidenhammer confirmed Monday morning. He said the company is working with authorities to investigate.
“Someone requested information posing as a Weidenhammer employee,” he said. “Unfortunately, the request came from bad guys that got the information.”
He said anybody who received a W-2 tax form for 2016 was affected. He was unsure how many people that was, but said the company has about 180 employees across all locations. The company is based in Reading and other offices are in Lancaster, Philadelphia, Colorado, Michigan and Texas, according to its website.
All of the affected people have been notified and the company is providing them with free credit monitoring through LifeLock, Weidenhammer said.
UGI Utilities was hit with a similar email scam in January, resulting in the personal information of about 1,900 employees and former employees being stolen.
These phishing scams often are sophisticated and may be planned over a significant period of time. The crooks investigate their target to determine which employees have access to the data they are seeking. Then they contact them with a well-disguised email in the name of a top official requesting the data.
I had warned about the scam not long before the UGI incident. Last week, the Pennsylvania Department of Revenue and the IRS warned that the fraud was expanding from the corporate world to public schools and non-profits.
“This large-scale theft can give criminals sensitive financial information about employees that can be used to commit various crimes, including tax identity theft by filing a fraudulent tax return in the name of a victim,” Revenue Secretary Eileen McNulty said.
“We encourage all employers to be on guard and to warn payroll and human resources employees about the scam,” she said.
Weidenhammer said his company had trained against phishing attacks such as this one.
“We actually showed people how to determine when an email was bogus,” he said.
That still didn’t prevent the data breach, an indication of how sneaky these scams are and how difficult they can be to spot. The misleading emails don’t always stand out as a scam because they often contain the actual name of a chief executive officer and may come from an email address that is similar to the executive’s true address.
“Somebody made a mistake thinking they were doing the right thing,” Weidenhammer said.
Last year, Main Line Health in suburban Philadelphia said an employee was duped into sending the personal information of the health system’s staff to someone who had emailed requesting the data. Snapchat, a video messaging company, also suffered a similar data breach last year when a scammer impersonated the company’s CEO and emailed an employee to ask for payroll information.
Weidenhammer provides strategy, marketing and technology solutions with “core competencies in consulting, software development, infrastructure solutions, cloud and managed services, digital/interactive design, as well as school district administrative solutions,” according to a news release on its website.
Find the Original Article Here