US Bank Workers May be Victims of ADP Data Breach

Some US Bank workers may be victims of tax fraud or identity theft after a data breach of ADP’s payroll portal exposed confidential W-2 information to cyber thieves, according to KrebsOnSecurity.

ADP is a third-party service provider that offers payroll, tax and benefits administration to its vast clientele of over 640,000 companies around the world.

The cyber attack was discovered last month by ADP client US Bank, which said that “a small population” of its 64,000 employees had its tax and salary data stolen from the payroll vendor portal.

US Bank Addresses ADP Data Breach

US Bank confirmed the ADP cyber attack incident, saying the company is not sure how cyber thieves originally obtained employee personal information to create fraudulent accounts with ADP.

In a signed letter by US Bank executive vice president of human resources Jennie Carlson addressed to what was described as a “small population” of the company’s workforce that may have been victim to the ADP data breach.

As such Carlson wrote, “During the course of that investigation we have learned that an external W-2 portal, maintained by ADP, may have been utilized by unauthorized individuals to access your W-2, which they may have used to file a fraudulent income tax return under your name.”

The letter to the affected parties went on to say, “the incident originated because ADP offered an external online portal that has been exploited. For individuals who had never used the external portal, a registration had never been established. Criminals were able to take advantage of that situation to use confidential personal information from other sources to establish a registration in your name at ADP. Once the fraudulent registration was established, they were able to view or download your W-2.”

To register on ADP, clients provide employees the company-specific link from ADP, and a company code. KrebsOnSecurity says cyber crooks took advantage of the available information and used them to create fake ADP accounts to obtain confidential W-2 information.

“Any potential exposure of W-2 information was limited to individuals who have had their personal information compromised previously (unrelated to ADP) based on ADP’s investigation to date,” the company said in a statement to CNBC. “Publishing unique registration codes to an unsecure website is not common practice. ADP actively advises against this practice, notifies clients of the potential risks and has temporarily disabled access to the registration portal for those clients that continue to publish company registration codes in this fashion.”

The W-2 hack has been popular with cybercriminals this year because the tax documents have all the information needed to file false tax returns and commit other identity theft related crimes and this not the first time third-party providers like ADP were used as a channel for tax fraud.

Last February, months before the year’s tax filing season drew to a close, the IRS issued a warning stating a 400 percent increase in identity theft scams that targeted tax information.

According to the FBI, from October 2013 through February 2016, schemes that made use of different techniques to steal such information for tax fraud purposes victimized over 17,600 people, amounting to billions in losses.

ADP officials said, “ADP has no evidence that its systems housing employee information have been compromised. Additionally, the company is working with a federal law enforcement task force to identify the fraud perpetrators.”

If you believe you were a victim of tax fraud or identity theft as a result of the ADP payroll security data breach, you may have grounds for legal recourse.

Join a Free ADP Data Breach Class Action Lawsuit Investigation

If your employer uses ADP to process payroll and you received an ADP paycheck or ADP W2 tax form, you could become the victim of tax fraud. You may be eligible to join a class action lawsuit investigation to help compensate you for past and future losses.

Join Now