Pivotal Labs W-2 Phishing (CEO-Spoof), 2016

What happened

On March 22, 2016, during U.S. tax-filing season, an unknown third party sent a Pivotal employee a fraudulent email crafted to look as though it came from the company's chief executive, requesting certain information about Pivotal employees. Believing the request was genuine, the employee replied with affected employees' 2015 Form W-2 data. The exposed data included each affected person's name, address, 2015 income information, and Social Security Number or Individual Taxpayer Identification Number (ITIN). Pivotal notified law enforcement and contacted the IRS, opened an investigation, and provided affected employees three years of AllClear ID identity protection at no cost, including identity-repair assistance and optional credit monitoring.

How it worked

The attack is a "CEO fraud" / business email compromise variant aimed at data rather than money. The fraudster posed as the chief executive and made a plausible, in-character request for employee information, exploiting the reflexive deference employees show to a message that appears to come from the top of the org chart. Tax season made a request touching W-2 or payroll data unremarkable, lowering suspicion. Because the ask was for information rather than a wire transfer, it could bypass financial-approval controls focused on payments. The recipient's reply exposed affected employees' tax records and created risks of fraud and identity theft.

The lure and the tell

The lure: an email appearing to be from the company's chief executive asking an employee for "certain information about Pivotal employees," landing during tax season when W-2 handling was routine. The tells (recognizable in hindsight): a sensitive bulk-data request arriving by email rather than through normal HR/payroll systems; the request coming top-down from an executive who would not normally handle W-2 files personally; and no independent verification via a second channel. As IRS Commissioner John Koskinen put it about this scam wave, "If your CEO appears to be emailing you for a list of company employees, check it out before you respond."

Outcome

Pivotal employees' 2015 W-2 data (names, addresses, income, SSN/ITIN) was disclosed to criminals, exposing affected staff to tax-refund fraud and identity theft. Pivotal reported the incident to law enforcement and the IRS, filed a breach notice with the California AG, and offered three years of AllClear ID protection, including its identity-repair hotline. No attacker was publicly identified and the count of affected employees was not disclosed. Pivotal was one of dozens of organizations (alongside Snapchat, Seagate and others) hit by the same W-2 phishing wave in Q1 2016.

Why it matters

This is an example of how impersonating authority plus well-timed, in-context framing can defeat otherwise careful people, and how a data-request BEC can sidestep controls focused on money movement. One employee's good-faith reply exposed affected employees' identity data. It shows why sensitive-data requests need the same out-of-band verification discipline as payment requests, and it illustrates the seasonal nature of W-2 phishing.

Defenses

Route all bulk PII/W-2/payroll requests through defined HR or payroll workflows, never ad-hoc email replies. Require out-of-band verification (known phone number, in person, or a separate ticketing channel) for any request for employee tax or personal data, regardless of who it appears to come from. Treat unusual executive requests as a red flag and make it safe and expected to double-check. Use email authentication (SPF/DKIM/DMARC) and external-sender/display-name-spoofing warnings to flag look-alike senders. Restrict and log who can access and export W-2 datasets, apply least privilege, and require approval for bulk exports. Run tax-season-specific awareness training on CEO-fraud W-2 scams. Have an incident plan ready: notify law enforcement and the IRS, file required breach notices, and offer identity-protection and tax-fraud monitoring to affected staff.