A spoofed email impersonating a company executive tricked a Main Line Health employee into emailing all ~11,000 staff W-2s to criminals.
Social Engineering Examples·5 sources
On February 16, 2016, an employee at Main Line Health received an email that appeared to come from a company executive requesting employee information. Believing it legitimate, the employee replied with personal data on essentially the entire workforce, reported as nearly 11,000 employees. The compromised data included names, home addresses, dates of birth, salaries, and Social Security numbers (W-2 information).
No patient information was involved. Main Line Health said it recognized the incident on/around March 1, 2016, shortly after the IRS issued national alert IR-2016-34 warning payroll and HR staff about an emerging executive-spoof W-2 phishing scheme; a review prompted by that warning surfaced the earlier response. The health system publicly disclosed the breach on March 2, 2016, alerted the IRS and FBI (who investigated), and offered affected employees free credit monitoring and a dedicated call center.
This is a well-documented, confirmed incident corroborated by first-party company statements, major regional news outlets, and the IRS's own contemporaneous alert.
This was a business-email-compromise style "CEO fraud" against a payroll/HR function. The attacker sent a spoofed email crafted to look as though it came from a senior Main Line Health executive, asking for a routine-seeming list of employee details or W-2 data. The request rode on a familiar workflow: HR and payroll legitimately handle bulk employee PII and W-2s during tax season, so a demand for that exact data did not look out of place.
The recipient acted on perceived authority and did not out-of-band verify the sender before replying with the full dataset. Because the message asked for information already in the employee's reach, no malware, credential theft, or system intrusion was needed; the data simply walked out in a reply email.
Lure: an email appearing to be from a named company executive requesting employee W-2s or a roster with names, SSNs, dates of birth, addresses, and salaries, timed to tax-filing season when such requests seem plausible. The IRS alert quoted characteristic wording such as "Kindly send me the individual 2015 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review." Tells: an executive emailing HR/payroll directly for bulk sensitive data rather than going through normal systems; a request to send SSNs/W-2s by email or attachment; urgency ("asap"); and a reply-to or sender address that does not exactly match the executive's real internal address.
Verifying the request through a known phone number or in person would have exposed it.
Personal data (including SSNs) for approximately 11,000 employees was exposed to criminals, putting the entire workforce at risk of tax-refund fraud and identity theft. Main Line Health disclosed the incident, notified the IRS and FBI, filed breach notifications, provided free credit monitoring and a support call center, and said it was reviewing internal policies and safeguards.
CEO Jack Lynch publicly urged other health care organizations and regional businesses to educate employees about phishing. No patient data was affected. No public arrest or dollar-loss figure has been tied to this specific incident.
This is a textbook example of the 2016 tax-season W-2 phishing wave that the IRS warned about in IR-2016-34 and that CSO Online tracked hitting 41+ organizations in Q1 2016. It shows that a single trusted reply, with no malware and no hacking, can expose an entire workforce's most sensitive data, and that healthcare organizations are targeted for employee data, not just patient records.
It also illustrates a durable control lesson: bulk PII/W-2 requests, even from an apparent executive, must be verified out-of-band before fulfillment.
Require out-of-band verification (a call to a known number, not a reply) for any request for bulk employee PII, W-2s, or SSNs, regardless of apparent sender seniority. Enforce that sensitive data is never sent by email reply/attachment; route it through access-controlled systems. Deploy email authentication (SPF/DKIM/DMARC) and external-sender/display-name-spoofing warnings.
Restrict who can access full employee datasets and add approval gates for bulk exports. Run tax-season-timed phishing awareness for payroll/HR staff specifically. Report W-2 losses fast to dataloss@irs.gov and the FBI IC3 so protective measures can be taken for employees.
Social Engineering Examples. “Main Line Health W-2 Executive-Spoof Phishing Breach”. Accessed 19 September 2026. https://socialengineeringexamples.com/main-line-health-w2-phish-2016
Not detailed in Main Line Health's own disclosures, but consistent with the broader 2016 BEC wave the IRS and CSO Online documented, attackers running this scheme typically identify a target company's payroll or HR staff and a real executive's name and title from public sources such as company websites, press releases, and professional-networking profiles, since spoofing an unconvincing or nonexistent executive would undermine the pretext.
Public executive names, titles, and org charts are difficult to suppress at enterprise scale and are often needed for legitimate business purposes, so the realistic control is not hiding this information but hardening the process it gets used against at Stage 4, where out-of-band verification catches an impersonated request regardless of how much the attacker learned beforehand.
The attacker crafted an email designed to appear as though it came from a senior Main Line Health executive. Per Main Line Health's own statement and the IRS's contemporaneous alert, this scheme relies on email 'spoofing,' typically a forged display name or look-alike sending address rather than any compromise of the executive's real account.
Email authentication standards (SPF, DKIM, DMARC) combined with external-sender banners and display-name-spoofing warnings help flag or block messages forged to look like they came from an internal executive before they reach the inbox.
On February 16, 2016, the spoofed email was sent to a Main Line Health employee, timed to coincide with tax season, when a request for W-2 and payroll data would look routine. The IRS alert documented near-identical wording used across the wave, including urgent phrasing asking recipients to send W-2 and earnings data 'asap.'
Tax-season-timed phishing-awareness training aimed specifically at payroll and HR staff, reinforced by the kind of sample wording the IRS published in IR-2016-34, helps recipients recognize this exact request pattern when it arrives.
Per Main Line Health's statement to FOX 29, the employee believed the email was a legitimate request from a company executive and did not verify it out-of-band before replying, sending back the personal data (names, SSNs, dates of birth, home addresses, and salaries) of essentially the entire roughly 11,000-person workforce.
A hard policy requiring out-of-band verification, a phone call to a known number rather than a reply, for any request for bulk employee PII, W-2s, or SSNs, regardless of the apparent sender's seniority, directly blocks the moment the scheme depends on.
Because the attacker asked for data the employee could already access, no malware, credential theft, or network intrusion occurred. The sensitive dataset left the organization directly inside the reply email, per Main Line Health's and CSO Online's accounts.
Policy and technical controls that prohibit sending bulk sensitive data by email reply or attachment, routing such requests instead through access-controlled systems with approval gates and data-loss-prevention tooling that flags large outbound PII/SSN transfers, would have stopped the data from leaving even if the earlier steps succeeded.
Per IRS guidance on this scheme, criminals who obtain stolen W-2 and SSN data typically attempt to monetize it quickly by filing fraudulent tax returns claiming refunds in victims' names, or by selling the data on black-market forums for others to commit tax or identity fraud. No confirmed monetization outcome, such as an arrest or a specific fraud case, has been publicly tied to this incident.
Reporting a W-2 data loss quickly to dataloss@irs.gov and the FBI's Internet Crime Complaint Center, as Main Line Health did, lets the IRS flag affected Social Security numbers for fraudulent-return monitoring, reducing the odds that stolen data is successfully monetized even after exfiltration.
Browse by what this case has in common with others in the library.
A spoofed email impersonating Seagate's CEO tricked an HR/payroll employee into emailing every 2015 W-2 to a scammer.
A Snap Inc. payroll employee emailed the W-2 and payroll data of roughly 700 current and former employees to an…
A fraudster impersonating CEO Rob Mee tricked a Pivotal employee into emailing back the W-2 tax data of the company's…
TV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller.
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller.
California's Attorney General and six county DAs found more than 10,000 paper patient records and hazardous/medical waste in unsecured.
TV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that stole data…
A lone, unidentified hacker jailbroke Anthropic's Claude Code coding agent with a fake "authorized bug bounty/pentest" pretext and paired it.
CVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters.
NTS IT Care used fake Microsoft/Apple security pop-ups to scare consumers, mostly older Americans.
Scammers papered roughly 200 counterfeit QR-code stickers over legitimate ParkMobile decals on downtown Orlando parking meters.
A Snap Inc. payroll employee emailed the W-2 and payroll data of roughly 700 current and former employees to an…
TV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
Hornetsecurity documented a QR-phishing (quishing) email sent to a single employee at a US-based MSP that spoofed an MFA-reactivation notice…
An attacker impersonated LastPass CEO Karim Toubba with an AI voice clone over WhatsApp, but the targeted employee spotted the…
Social Engineering Examples