Wallace Community College Selma

Summary

A phishing attack compromised current and former employees' personal and financial information at Wallace Community College Selma when a staff member inadvertently responded to a fraudulent email impersonating an internal request. The incident resulted in unauthorized disclosure of W-2 forms containing sensitive data. Legal representatives specializing in cybersecurity confirmed the breach occurred following the employee's actions, characterizing it as an accidental leak stemming from the phishing scam. The exposure affected both active and former personnel, with compromised details including tax-related documentation and other confidential records. No external threat actor infiltration beyond the deceptive email scheme was indicated in the disclosure.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 5, 2018, Wallace Community College Selma experienced a data breach involving unauthorized disclosure of current and former employees' personal and financial information. The incident occurred when a college employee received a phishing email impersonating an internal authority figure at the institution. Believing the request to be legitimate, the employee complied by releasing W-2 tax forms containing sensitive data. The phishing attack successfully deceived the employee through spoofed credentials that appeared to originate from within the college's organizational structure. No technical system compromise or malware installation occurred, as the breach resulted entirely from human error in responding to the fraudulent email request. The compromised W-2 forms typically contain Social Security numbers, addresses, income details, and other personally identifiable information used for tax reporting purposes.

Wallace Community College Selma engaged Mullen Coughlin LLC, a legal firm specializing in cybersecurity and data privacy incidents, to manage the breach response. Attorney Alex Walker from the firm publicly confirmed the accidental data leak on February 24, 2018, nearly three weeks after the initial incident. The disclosure occurred through media channels rather than direct institutional announcements, with the Selma Times-Journal serving as the primary news outlet covering the event. The college implemented standard breach response protocols through its legal representation, though specific remediation measures for affected employees were not detailed in public reports. The incident exclusively impacted current and former staff members through compromised employment records, with no indication of student data exposure or additional system intrusions beyond the initial phishing-induced disclosure.

Sources

Sources available to members: 1 source.