PRINCETON — Mercer County Schools employees will received identity theft protection for a year after a security breach targeting their W-2 forms information was reported to the FBI and the West Virginia Attorney General’s Office.
“There was a security breach,” Paul Hodges, president of the Mercer County Board of Education said Friday evening. The breach occurred when unauthorized individuals asked the employees via internet for their W-2 forms information. Hodges did not know how many employees had been impacted by the scam.
No students’ information was taken, he said.
Superintendent Dr. Deborah Akers has notified the FBI and the state Attorney General about the breach, and both agencies will be investigating, Hodges said. The board of education is taking an extra step to help employees whose personal data may have been compromised. All employees will have identify theft protection for a year at the board of education’s expense.
West Virginia Attorney General Patrick Morrisey said Friday in a press release that an email phishing scam has already targeted two entities in southern West Virginia. Staff members received fraudulent emails from an address similar to the one used by their chief supervisor. The emails, typically sent to human resource and payroll divisions, request wage information and Form W-2s from all employees.
Any recipient who replies to the email and sends the information as requested, unknowingly turns over that data to the perpetrator, who then uses the Form W-2s to file false tax returns, Morrisey stated.
“Tax season is upon us and scammers are ready to pounce,” he said. “Everyone must be careful and closely examine any request for employees’ Form W-2. Check, double and triple check any such email to make sure it’s legitimate.”
The Internal Revenue Service has reported that the scam targets schools, restaurants, hospitals, tribal groups and nonprofits. Anyone receiving a tax-related email must closely examine the email address. The fraudulent email often will include a slight variation from the legitimate address, according to the Attorney General’s Office press release. Recipients also are urged to contact their supervisor by phone or in-person to verify the request.
Beyond those tips, recipients should never hit reply if there is the slightest bit of concern.
Anyone who believes they have received such an email or believes their information to have been compromised can contact the Attorney General’s Consumer Protection Division at 1-800-368-8808 or visit the office online at www.wvago.gov.
— Contact Greg Jordan at email@example.com