The New Jersey State Bar Association recently met to discuss, among other things, our favorite topic: Cybersecurity. (Perhaps our esteemed Privacy, e-Communication and Data Security Practice Group chair was there….) We wanted to briefly mention two critical points discussed:

  • Critical Point #1: The biggest risk out there is employees. We employees click on all sorts of attractive nuisances (we love those W-2 phishing scams), share our passwords with our colleagues, lose thumb drives, and leave our laptops in our cars, ripe for theft. We (generally) mean well – we just need training! Training is a critical element of an information security plan, so be sure to train your employees. But don’t just train them once – as is evident from the fact that employees are consistently at the top of the list of cybersecurity risk factors, we need to have security details reinforced (perhaps repeatedly). Therefore, it is important to periodically refresh that training. (Yes, we can help you with that – here is information on the resources our practice group offers.)
  • Critical Point #2: As noted in a blog post from earlier this year, employers can have vicarious liability for data breaches by employees. When that breach occurs, companies should be sure to have appropriate insurance in place to cover the resulting expenses. Talk to your insurance agent and be sure your company has insurance to cover the potential incidents that may arise in connection with your operations, and which provides the company with assistance with the different costs it may incur, such as investigation, mitigation, public relations, breach reporting and compliance, and possible business interruption.

Oh, one more thing….Rapid7 issued its Quarterly Threat Report earlier this week. While health care has always been among the top threat sectors, this Quarterly Threat Report indicates that health care is now bumping up to the top spot, eclipsing the financial industry as a cybersecurity target. This is due to both the rich nature of the data that health care entities maintain, and to the vulnerable nature of their systems. The Report notes that “healthcare organizations often have a complex, distributed IT infrastructure with difficult-to-patch legacy systems and proprietary medical devices, making them challenging to secure quickly. They also rely on system availability to keep operations running when lives are on the line, and adversaries have frequently targeted that availability using tactics such as ransomware or telephonic denial of service attacks (TDoS) to overwhelm critical phone lines. “

The Jackson Lewis Privacy, e-Communication and Data Security team can help your organization with a Data Breach Readiness Assessment. More information about our Data Incident Response Team is available here.

Last February, the IRS issued a warning to all employers regarding the resurgence of a W-2 based cyber scam. The scam, which targets businesses during tax season, was also “spreading to other sectors, including school districts, tribal organizations and nonprofits.” In August 2017, the IRS renewed its warning to tax professionals and businesses as part of its “Don’t Take the Bait” campaign. In October, the IRS reminded the public about its procedures for reporting successful or failed attempts. With the tax season quickly approaching, it’s worth re-visiting how an employer can fall prey to this scam, describing how they can avoid it, suggesting they have a response plan in case they are a victim.

The cyber-scam consists of an e-mail sent to an HR or Accounting department employee, presumably from an executive or “higher-up” within the organization. Both the TO and FROM e-mail addresses are legitimate internal addresses, as are the “sender” and recipient names. The fake e-mail asks the employee to forward the company’s W-2 forms, or related tax data, to the “sender.” This request aligns with the job responsibilities of both the employee and the supposed internal “sender.”

Despite its appearance, the e-mail is a fake. The scammer is “spoofing” the company executive’s identity. In other words, the cyber-criminal is assuming the executive’s identity and e-mail address for the purpose of sending what appears to be a legitimate request for sensitive company information. The unsuspecting employee relies on the accuracy of the sender e-mail address, coupled with the sender’s job title and role, and forwards the confidential W-2 information. The information goes to a hidden e-mail address controlled by the cyber-criminal.

If successful, the cyber-criminal obtains a trove of sensitive employee data that can include names, dates of birth, addresses, salary information, social security numbers, and well as employer information needed for tax filings. The information is used to file fake individual tax returns (Form 1040) which generate fraudulent tax refunds or it is sold on the dark web to identity thieves.

This cyber-scam is form of ‘spear phishing’ known as business email compromise (BEC) attacks, or CEO spoofing. Spear phishing attacks target a specific victim by using personal or organizational information to earn the victim’s trust. The cyber-criminal uses information such as personal and work e-mail addresses, job titles and responsibilities, names of friends and colleagues, personal interests, etc. to lure the victim into providing sensitive or confidential information. Quite often, the scammer culls this information from social media, LinkedIn, and corporate websites. The method is both convincing and highly successful.

While an organization can use firewalls, web filters, malware scans or other security software to hinder spear phishing, experts agree the best defense is employee awareness. This includes ongoing security awareness training (see our white paper with best practices for setting up a training program) for all levels of employees, simulated phishing exercises, internal procedures for verifying transfers of sensitive information, and reduced posting of personal information on-line.

A W-2 e-mail phishing scam can have a devastating impact on a business and its employees. With tax season around the corner, expect to see more creative attempts to bait your personnel.

In the event your business is a victim of such an attack, it needs to be prepared to respond. This may require steps such as (i) being prepared to investigate the nature and scope of the attack, (ii) ensuring that the attackers are not still present in its systems, (iii) determining whether notification is required under applicable state law to individuals and state agencies, (iv) reporting to the IRS at phishing@irs.gov and the Internet Crime Complaint Center of the FBI, and (v) helping employees who may have questions about rectifying their tax returns.

Before Forms W-2 have to be generated (generally on or before January 31, 2018), business should be creating awareness in their organizations about these scams to avoid them from happening, but also making sure they are prepared to respond in the event a scam is successful.