{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2016-snapchat-payroll-staff-phished-by-fake-ceo-request-for-employee-w-2s"},"incident":{"title":"Snapchat payroll staff phished by fake CEO request for employee W-2s","date":"2016-02-28","date_precision":"day","victim_org":"Snapchat, Inc.","sector":"Technology","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Spear Phishing (Email)"],"ai_involvement":"No AI reported","ai_notes":"No AI involvement reported.","outcomes":["Data Breach","Identity Theft"],"loss_usd":null,"loss_note":"No wire loss reported; exposure was employee payroll and identity data.","records_affected":null,"threat_actor":null,"summary":"On 28 February 2016 Snapchat's payroll department received an email impersonating chief executive Evan Spiegel and requesting employee W-2 forms, and complied. Snapchat publicly acknowledged the error, said it would take care of those affected, and offered two years of free credit monitoring. It did not disclose the number of employees whose data was disclosed.","how_it_worked":"The message was a classic CEO-fraud W-2 lure: a spoofed executive sender, minimal detail, an implied deadline, and a request that fell squarely inside the recipient's normal duties during US tax season. The lever was hierarchical authority combined with the reluctance of a junior payroll employee to question a terse instruction that appears to come from the founder. The extracted action was a single email attachment containing employees' names, addresses, Social Security numbers and wage data, which criminals use to file fraudulent federal tax returns and claim refunds before the real employee files.","lessons":"Enforce a standing rule that no bulk tax or identity data leaves the organisation by email, backed by outbound DLP inspection for W-2 patterns and mandatory verbal verification of executive data requests.","confidence":"Confirmed","sources":[{"title":"Snapchat and Seagate fall prey to new W-2 scam","url":"https://www.cbsnews.com/news/snapchat-and-seagate-fall-prey-to-new-w-2-scam/","publisher":"CBS News"}],"entry_type":"incident","slug":"2016-snapchat-payroll-staff-phished-by-fake-ceo-request-for-employee-w-2s","year":2016,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2016-snapchat-payroll-staff-phished-by-fake-ceo-request-for-employee-w-2s"}}