{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2017-irs-warns-of-w-2-phishing-epidemic-spreading-to-school-districts-and-non"},"incident":{"title":"IRS warns of W-2 phishing epidemic spreading to school districts and nonprofits","date":"2017-02-02","date_precision":"day","victim_org":"US school districts, tribal organizations, nonprofits and employers (multi-victim campaign)","sector":"Education","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Spear Phishing (Email)"],"ai_involvement":"No AI reported","ai_notes":"No AI involvement reported in the IRS alert.","outcomes":["Data Breach","Identity Theft","Wire Fraud / Financial Loss"],"loss_usd":null,"loss_note":"The IRS did not publish an aggregate dollar figure; it stated some organisations lost both employee W-2s and thousands of dollars in wire transfers.","records_affected":null,"threat_actor":null,"summary":"In news release IR-2017-20, issued 2 February 2017, the IRS warned that the W-2 spear phishing scam had spread well beyond corporations to school districts, tribal organizations and casinos, nonprofits, chain restaurants, temporary staffing agencies, healthcare providers and shipping and freight companies. The agency also flagged an evolved variant that follows the W-2 theft with a fraudulent wire transfer request.","how_it_worked":"Criminals spoofed an organisation's executive and emailed payroll or human resources staff asking for a list of all employees and their Forms W-2. School districts and small nonprofits were attractive because payroll is often handled by one or two people with no formal verification procedure and no security team. After the W-2 file was sent, the same spoofed executive followed up with a request to the payroll or comptroller staff to wire funds to a specified account, exploiting the compliance momentum created by the first successful request. Some organisations lost both the employee data and the money.","lessons":"Small public-sector and nonprofit payroll functions need a written, mandatory callback rule for executive requests, since they lack the compensating controls larger firms rely on.","confidence":"Confirmed","sources":[{"title":"IR-2017-20: Dangerous W-2 Phishing Scam Evolving; Targeting Schools, Restaurants, Hospitals, Tribal Groups and Others","url":"https://www.irs.gov/pub/irs-news/ir-17-020.pdf","publisher":"Internal Revenue Service"}],"entry_type":"campaign","slug":"2017-irs-warns-of-w-2-phishing-epidemic-spreading-to-school-districts-and-non","year":2017,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2017-irs-warns-of-w-2-phishing-epidemic-spreading-to-school-districts-and-non"}}