Govt. Cybersecurity Contractor Hit in W-2 Phishing Scam
Summary: Defense Point Security, a Virginia contractor providing cybersecurity services to the federal government, told current and former employees on March 16 that a team member fell for a targeted spear phishing email and released the W-2 tax data of everyone employed there in 2016, including names, Social Security Numbers, addresses, compensation and tax withholding amounts. CEO George McKenzie said in the employee email that the W-2s were sent outside the company, and the notice did not state when the incident occurred, who received the data, or how many employees were affected.
Key Takeaway: The data left openly by email rather than through a stealthy exfiltration, which points to missing or misconfigured data-loss prevention on SSN-format information at a company trusted with the ICE Security Operations Center in Phoenix, and W-2 forms carry what fraudsters need to file a return and claim a refund in someone else's name.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026