It’s a sad day for faculty and employees at Tidewater Community College (TCC). The Virginia-based college was recently the victim of a spear-phishing attack, and the attacker walked away with the tax information of around 3,000 employees.

At some point earlier in the month, according to SC Magazine, a school employee received an email from what appeared to be a TCC account, requesting W-2 information. The employee forwarded the requested information to the address, and in doing so handed over the tax information for thousands of employees in a single blow.

The error cost the college the names, Social Security numbers, earnings and tax information for current and former employees, including full-time, part-time, adjunct, and student workers. While their addresses, birth dates, marital information, email addresses, and banking information were not lost, much of that information is easy to find by searching up a victim’s information.

Around sixteen people have already reported that a fake tax return was submitted using their personal information, as the attacker filed under their names to steal their returns. In response, the school is working with a credit monitoring service to help employees find out if their stolen information is being used, and has suggested that all workers who have not yet filed their taxes do so immediately.

As a further reaction to the attack, TCC has begun a cybersecurity training program for employees that manage important information, so as to prevent such an attack from happening again. It’s also conducting an investigation, in hopes of finding the attacker and securing the stolen information.

Image by Alexas Fotos