Seagate Staff Exposed: Phishing Scam Nabs W2 Forms

Seagate has suffered a massive data breach as the result of a phishing scam, according to a new report. The scammer[s] sent a fraudulent email to a Seagate employee who believed the message to be a legitimate internal business request. One thing lead to another, and the scammers ended up making off with the 2015 W-2 tax information for all past and present U.S. staff.

It's an unfortunate — but not at all uncommon — scenario. Someone in search of data takes the path of least resistance and sends someone else emails carefully tailored to look official. Phishing emails may use the name of an existing worker, a design identical to that of legitimate companies, or email addresses one character off from official email addresses. If the recipient fails to notice, they may give away data unknowingly to a scammer.

According to a new report from Krebs on Security, that's what happened recently at Seagate. On March 1, a Seagate employee sent a phishing scammer W-2 tax forms belonging to former and current Seagate staff based in the United States, doing so under the belief the request was a legitimate work order.

Speaking to Krebs, Seagate spokesperson Eric DeRitis said:

When we learned about it, we immediately notified federal authorities who are now actively investigating it. We deeply regret this mistake and we offer our sincerest apologies to everyone affected. Seagate is aggressively analyzing where process changes are needed and we will implement those changes as quickly as we can.

Several thousand, but less than 10,000, people were affected. Workers are being offered a couple years of Experian ProtectMyID monitoring, but the loss of tax forms exposes the workers to tax return fraud, an issue that is rampant this time of year and was the source of 2015's major IRS hack.

SOURCE: Krebs on Security