A computer hacker or hackers posing as a district’s school superintendent have tried to trick at least three Maine school departments into handing over sensitive personal information contained on employees’ W-2 forms – and succeeded at least partially with one of them.

The breadth of the email scam came to light Tuesday after Brunswick Superintendent Paul Perzanoski apologized to school department employees whose W-2 forms were sent to a fake email address. The worker who sent the forms thought it was in response to an email request from Perzanoski.

But in a letter sent to all employees Tuesday, Perzanoski said the worker who was duped into sending the W-2 forms was suspicious enough to delete everyone’s Social Security numbers. More than 400 workers are employed by Brunswick schools.

“Last week, a hacker got into our system and posed as the superintendent,” Perzanoski wrote. “The W-2 forms were sent to the fake address but without social security numbers on them, as our employee was adept enough to feel uncomfortable about including them.”

Perzanoski notified the Brunswick Police Department, which is investigating the scam. The Brunswick schools’ technology department is also investigating.

Perzanoski said that since the Social Security numbers were removed, “any risk to our personal information appears minimal.”

Advertisement

A W-2 form shows the amount of taxes withheld from a person’s paycheck and is used when filing federal and state tax returns. In addition to a Social Security number, the form also contains a person’s name, address and annual earnings.

Perzanoski said Social Security numbers are often used by hackers who are involved in personal identity theft scams.

Brunswick is not the only school department targeted by the scammers. According to Jeremy Ray, superintendent of schools in Biddeford, his department successfully deflected the scammers from grabbing sensitive data last week. Kittery schools were also targeted, Ray said.

Ray said the scam started March 23 when business department employees were contacted via email by a person seeking W-2 forms for Biddeford school employees. The person identified himself as Ray, and a picture of Ray popped up if the cursor hovered over the email. In the email, the impostor asked that the information “kindly” be forwarded, a word Ray says his staff knows he wouldn’t use.

His staff became suspicious and wondered why he wanted the information. When the staff asked the impostor, who was using an AOL email address, what the deadline was for providing the forms, the fake Ray said he needed the forms by the end of the day. “It just didn’t make sense,” Ray added. “As superintendent, I would have no reason to have a copy of everyone’s W-2 form.”

Biddeford did not turn over any information to the scammer and Ray notified the Maine School Superintendents Association. Biddeford schools employ more than 500 people.

Since then, Elaine Tomaszewski, acting executive director of the superintendents association in Augusta, has warned districts across Maine about the email scam.

“Superintendent Jeremy Ray has alerted us that there may be an email scam. A fake email appearing to be sent from him went to his business office requesting all of the W-2 information for Biddeford employees,” Tomaszewki said. “He is worried that similar ruses may be going to other superintendents. He said it was a very good fake.”

 


Only subscribers are eligible to post comments. Please subscribe or login first for digital access. Here’s why.

Use the form below to reset your password. When you've submitted your account email, we will send an email with a reset code.