Forest Global Training Partners

Cyber Risks · Krebs on Security

Fraudsters Steal Tax, Salary Data From ADP

Summary: Identity thieves stole tax and salary data from ADP by registering accounts in the names of employees at more than a dozen customer firms, including a "small population" of U.S. Bank's more than 64,000 employees. ADP said the victim companies had published online the company-specific signup link and static company code, and that the thieves already held victims' names, dates of birth and Social Security numbers, which did not come from ADP's systems.

What you should know: The authenticators guarding W-2 data were a published link and a static code ADP itself characterized as an identification code rather than an authentication code, and the underlying SSN and date of birth sell in the cybercrime underground for less than $4. ADP's answer is knowledge-based authentication, the same approach the IRS removed after fraudsters used its Get Transcript service to pull W-2 data on more than 724,000 taxpayers.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related