HAMPTON ROADS, Va. (WAVY) – Thousands of employees at Tidewater Community College have had their personal data stolen following a “serious” security breach announced Friday.
“We’ve just been focused on the employees that are affected and setting up services for them,” said Marian Anderfuren, a spokesperson for the college.
Earlier this month, a hacker impersonated a TCC employee via email, and requested that another TCC employee send W-2 data from 2015, according to Anderfuren.
That file, which contained the names, social security numbers and wage data for 3,193 employees, was sent.
“I’m just kind of worried now. If it’s happening here, it’s happening everywhere and I mean, at least I thought here, it would be a little bit more secure,” said Benjamin Cason, a long-time TCC employee.
Cason said he already filed his taxes this year, without issue.
But according to Anderfuren, 16 other employees weren’t as lucky. When those individuals went to file their taxes, they discovered that someone else had already done so. That number is likely to rise.
“This is an anxious time of the year to begin with, because it’s tax-filing season and this adds another layer of anxiety to what folks are dealing with,” Anderfuren said.
Right now, TCC is providing free credit monitoring to everyone at risk. Employees who handle sensitive information will be receiving cybersecurity training.
Anderfuren said she had no information regarding whether the employee who sent the data would be reprimanded.
School officials became alarmed of the hack after 15 employees reported the tax scam. Initially, officials assumed the reports were unrelated, until one employee noted that the transcript of the false tax filing matched her W-2 exactly. TCC discovered the breach Thursday.
Both the FBI and Virginia State Police have been contacted for help.
Anderfuren said that employee addresses, birth dates and spousal information were not obtained in the hack.
If you were a TCC employee in 2015, there are several immediate steps you can take to protect your information:
- Contact one of the three major credit-reporting agencies – Equifax, TransUnion, or Experian – to place a fraud alert on your credit file.
- Complete and submit IRS Form 14039: Identity Theft Affidavit. It alerts the IRS that you have reason to believe your personal information may be used fraudulently. Get the form here: https://www.irs.gov/Help-&-Resources/Tools-&-FAQs/FAQs-for-Individuals/Frequently-Asked-Tax-Questions-&-Answers/IRS-Procedures/Reporting-Fraud/Reporting-Fraud
If you believe your personal information has already been used, you can do the following:
- Report the identity theft to the Federal Trade Commission: http://www.idtheft.gov. You can also call 1-877-IDTHEFT.
- File an identity theft report with your local police. The police report is necessary if you want to apply for a new Social Security number.
- Report the theft of your Social Security number to the Internet Crime Complaint Center: http://www.ic3.gov/.
- Report your incident to TCC by using this online form: http://forms.tcc.edu/identity-theft-report/
TCC plans on adding a frequently asked questions link about the breach to its website. It will be posted here: www.tcc.edu