Seagate W-2 Phishing Breach (2016)

What happened

On or about March 1, 2016, Seagate experienced a phishing incident that resulted in disclosure of 2015 Form W-2 data for individuals who had worked for Seagate and certain corporate affiliates during 2015. Seagate learned of the disclosure, notified relevant authorities, and later mailed formal breach-notification letters. The exposed data included names, addresses, Social Security numbers, and earnings.

How it worked

The attack was a phishing request sent to staff who handled sensitive tax records. The request sought W-2 data during tax season, and the employee voluntarily emailed the data outside the company.

The lure and the tell

Lure: a phishing email requesting copies of 2015 employee W-2 forms. Tells: a bulk request for highly sensitive tax data delivered by email rather than through established payroll systems and no out-of-band confirmation of the request.

Outcome

W-2 data for several thousand US employees was in criminal hands, with tax-refund fraud as a downstream risk; plaintiffs alleged that some affected employees were informed that fraudulent tax returns had been filed in their names. Seagate notified the IRS, which added extra scrutiny or watches to affected employees' tax accounts, and federal law enforcement, sent breach notifications, stood up an Epiq-run call center, offered two years of free Experian ProtectMyID credit monitoring with $1,000,000 identity-theft insurance, and pledged additional phishing training and process changes. The breach also spawned an employee class action against Seagate Technology LLC. Top Class Actions reports final approval on March 14, 2018. In their July 2017 preliminary-approval motion, plaintiffs estimated the identity-protection value at approximately $5.75 million and potential backstop coverage at more than $42 million. These were estimated benefits and potential coverage, not money stolen or proof of payments to class members.

Why it matters

This is a textbook example of how a social attack can exfiltrate sensitive employee data through one trusted person. It shows why W-2 phishing is effective: it uses a plausible request against a role that routinely handles the data being sought.

Defenses

Require out-of-band verification for any bulk request for W-2s, PII, or payroll/tax data, regardless of who appears to be asking. Never transmit W-2/tax data by email; route it only through controlled systems with access logging. Treat unexpected email requests as impersonation risk: deploy sender-authentication, external-sender banners, and lookalike/display-name spoofing detection. Restrict who can export bulk W-2 data and add a second-approver control on such exports.