It’s fine to go fishing at sea, but significantly less so to go phishing at Seagate. Unfortunately for Seagate Technology LLC employees, the storage device manufacturing company has been hooked by a targeted phishing attack, and a scammer has run off with their income tax data.

According to arstechnica, a Seagate employee received what they assumed was a legitimate email from CEO Stephen Luczo, which requested the 2015 W-2 forms for all current and former employees. Under the assumption that the email was real, the employee sent the data to the outside email address.

And thus, the scammer obtained the personal and financial information of Seagate’s many employees.

The company is working with law enforcement to resolve the situation, but the damage is already done. Employees have been alerted to keep an eye out for any suspicious behavior in their names.

Seagate is also offering two years of credit protection from Experian’s ProtectMyID service. However, given the time of year and the nature of the information stolen, it’s more than likely that the scammer’s goal is tax refund fraud, which credit monitoring does not protect against.

With the W-2 forms in hand, the fraudster now has all the information needed to fraudulently file the employees’ taxes and take their refunds. As annoying as filing tax forms may be, it is most assuredly a bigger pain to have someone else do it with fake information to steal a large refund. Those who have filed their taxes earlier this year may already be safe for now, but with several thousand employees affected, many may soon be dealing with the consequences.

Hopefully the Seagate case can be resolved and closed quickly, and the scammer caught. But this stands as yet another warning of the damages a data breach can do, and why employees and companies must always be on guard for fraudulent emails, especially where employee data is concerned.

Image by Alexas Fotos