What happened
On 28 February 2016 Snapchat's payroll department received an email impersonating chief executive Evan Spiegel and requesting employee W-2 forms, and complied. Snapchat publicly acknowledged the error, said it would take care of those affected, and offered two years of free credit monitoring. It did not disclose the number of employees whose data was disclosed.
How the deception worked
The message was a classic CEO-fraud W-2 lure: a spoofed executive sender, minimal detail, an implied deadline, and a request that fell squarely inside the recipient's normal duties during US tax season. The lever was hierarchical authority combined with the reluctance of a junior payroll employee to question a terse instruction that appears to come from the founder. The extracted action was a single email attachment containing employees' names, addresses, Social Security numbers and wage data, which criminals use to file fraudulent federal tax returns and claim refunds before the real employee files.
AI involvement · No AI reported
No AI involvement reported.
The control that would have caught it· our reading, not a claim from the sources
Enforce a standing rule that no bulk tax or identity data leaves the organisation by email, backed by outbound DLP inspection for W-2 patterns and mandatory verbal verification of executive data requests.
Sources (1)
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.