Another Healthcare Related Organization Becomes Next Victim of W-2 Theft

Those W-2 forms most of us receive in order to file our income taxes are full of valuable information such as social security numbers and wage information. That is why this type of phishing continues to be on the uptick. Several high-profile companies have been in the news for employees falling victim to business email compromise (BEC) attacks requesting W-2s, including Seagate and Snapchat.

The latest victim of this is in the healthcare industry was eHealth, Inc. According to a notice posted by the California attorney general’s office, one of eHealth’s employees received an email from an executive at the company requesting W-2 information. Before anyone could determine it was a spoofed email address, the damage had been done. The number of affected employees has not been disclosed.

• Anyone who has been the victim of this type of breach should certainly be monitoring credit reports diligently, at least for two years following discovery of such an incident. In this case, eHealth is offering free access to credit and identity theft monitoring services for that timeframe. If it’s ever offered, take advantage of it. While it will not prevent your credit from being used to open accounts or prevent identity theft, notifications are sent to you if your credit report is requested.

• If you don’t intend to use your credit for a while, consider putting a freeze on your report. That will prevent anyone from accessing it. Just remember that if you do decide to apply for credit, you will need to lift the freeze, even if only temporarily.

• In addition to doing that, file your income taxes early. This will prevent a criminal from beating you to it and having your return sent to him.

The IRS is warning again this year that tax fraud due to W-2 BEC is prevalent and has spread beyond the corporate world. It is now going after school districts, non-profits, and tribal organizations. Recently Campbell County Health in Wyoming was hit proving that even smaller organizations are not safe from this. IRS Commissioner John Koskinen is quoted on the IRS website, “This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns. We need everyone’s help to turn the tide against this scheme.”