Cyber Incident Victim: Global Communications, Inc.
Date:
Feb 2016
Location:
United States of America
Summary
A phishing attack compromised employee tax information at a telecommunications company when a third party impersonated an executive via email to obtain W-2 forms. The payroll department initially questioned the fraudulent request but ultimately disclosed sensitive data, including Social Security numbers, addresses, income details, and tax withholdings for over 2,500 current and former staff. The breach did not affect customer data or internal IT systems. Upon discovery, the company notified law enforcement and initiated an investigation while providing affected individuals with credit monitoring, identity theft counseling, and insurance. Management confirmed the incident resulted from employee deception rather than malicious intent and reinforced existing phishing awareness training programs.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 24, 2016, a third party successfully obtained 2015 W-2 tax forms for all employees of Alaska telecommunications company GCI and its subsidiaries Denali Media, UUI, and Unicom through a targeted email phishing attack. The attacker impersonated GCI Chief Financial Officer Pete Pounds in communications with the company's payroll department, initially requesting employee payroll information and specifically demanding W-2 forms for all personnel who worked at GCI during 2015. Although the payroll department employee who received the fraudulent email recognized the request as unusual and questioned it, the attacker persisted in subsequent communications. Ultimately, the employee complied by emailing the sensitive documents to the unauthorized third party. The compromised data included names, addresses, Social Security numbers, income details, and tax withholding information for more than 2,500 current and former employees.
GCI management discovered the breach on March 3, 2016, and immediately notified the FBI while launching an internal investigation. Executive Vice President Greg Chapados informed affected employees via email on March 4, confirming no customer information was exposed and emphasizing that corporate IT systems and networks remained uncompromised. The company implemented remedial measures including two years of credit monitoring, identity theft counseling services, and identity theft insurance for impacted personnel. GCI advised employees to notify the IRS about the W-2 compromise and reiterated its existing phishing awareness training programs. Company spokesman David Morris clarified that the payroll employee involved had not been terminated, stating the disclosure resulted from insufficient phishing recognition rather than malicious intent. The investigation remained ongoing with no identified perpetrators at the time of public disclosure.