Tax Fraud Gang Targeted Healthcare Firms
Summary: An organized cybercrime gang stole login credentials at third-party payroll and HR provider UltiPro and used them to pull W-2 data from healthcare and senior living organizations, then filed fraudulent tax refund requests with the IRS on those employees. Victims named in the gang's web-based control panel included Griffin Health Services subsidiaries and Swan Home Health, a subsidiary of Assisted Living Concepts, which had disclosed a December 2013 breach affecting approximately 43,600 current and former employees.
What's compelling: Every victim organization in this series had outsourced payroll or HR to the same provider, so a single set of stolen administrator credentials at UltiPro reached employees across many companies at once. UltiPro only added an eight-digit text-message access code for W-2 records on February 9, 2014, after a large number of its customers had already been compromised.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026