City of San Marcos employees targeted in email scam

Targeted scam hits 800 San Marcos employees

More than 800 people employed by the City of San Marcos in 2016 have had their information compromised after a spear phishing attack.

City leaders learned of the incident earlier this week after several employees noted issues while trying to file their taxes with the IRS.

"From what we were led to understand, the e-mail address was made to look like a city e-mail address. It was titled as if it was sent from a mobile device, but it appeared to be from somebody employed within the (city)," explained Heather Hurlburt, San Marcos' Finance Director.

On Feb. 22, a scammer reached out to a staffer in the city's payroll department, requesting W2 information for city employees. On March 13, officials found out and began contacting those affected employees.

"Of course I was extremely concerned, because yes- my information was out there also. I'm very happy with the way that we have been on this and trying to prevent, and provide tools to make sure that people's identification is protected. It is a scary thing to have your information compromised," Hurlburt said.

In response to the incident, the city will provide three years of identification monitoring to affected employees. 

The affected accounts have been flagged by the IRS. The city is working to contact former employees by mail of the breach.

Hurlburt did not identify the employee who sent the email, but stated they were tenured. She classified the incident as "human error."

City officials are working with local law enforcement and IRS agents to investigate this situation.

"We will continue making sure that our employees are aware. I know I've sat down with my employees, and reiterated - 'always take that 30-second step back when you look at something. If it seems like the information would not be something you normally send to that person, or you're receiving e-mails with attachments on them that's not from someone that you know, always take that second to step back and verify,'" said Hurlburt.

She added she was unaware of similar spear phishing attacks happening in other municipalities.  

© 2017 KVUE-TV


JOIN THE CONVERSATION

To find out more about Facebook commenting please read the
Conversation Guidelines and FAQs

Leave a Comment