Sprouts Farmers Market

Summary

Sprouts Farmers Market experienced a data breach when an employee fell victim to a phishing email impersonating a senior executive, resulting in the unauthorized disclosure of 2015 W-2 tax forms for all approximately 21,000 employees. The compromised data included sensitive personal and financial information, potentially exposing affected individuals to identity theft risks. The supermarket chain engaged the FBI and IRS to investigate the incident and mitigate impacts on staff. This incident highlighted vulnerabilities in handling bulk sensitive data requests, as payroll personnel had unrestricted access to compile and transmit the information without additional verification protocols.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Sprouts Farmers Market experienced a data breach in March 2016 when an employee fell victim to a phishing scam targeting W-2 tax information. The incident occurred after an unauthorized individual impersonated a Sprouts senior executive via email and requested the 2015 W-2 statements for all company employees. The recipient, described as a payroll employee, compiled and transmitted the complete set of sensitive tax documents before the organization recognized the fraudulent nature of the request. The breach impacted approximately 21,000 workers across the company's 200-store supermarket chain headquartered in Phoenix, Arizona. Sprouts publicly confirmed the incident through spokesperson Donna Egan on March 22, 2016, acknowledging that all employees who received a 2015 W-2 from the company were potentially affected. The compromised data included sensitive personal information typically found on W-2 forms, exposing workers to potential tax fraud and identity theft risks.

Following discovery of the breach, Sprouts initiated response measures focused on investigation and protection of affected personnel. The company engaged federal law enforcement agencies, specifically partnering with the FBI and IRS to investigate the criminal activity and develop strategies to safeguard employee tax information. While Sprouts did not disclose technical details about how the phishing email bypassed existing security measures or the exact timeline between compromise and detection, the organization emphasized its collaboration with authorities to address the incident's consequences. No information was provided regarding whether the company implemented immediate changes to email verification procedures or data handling protocols following the breach. The incident represented one of several high-profile W-2 phishing attacks occurring during early 2016, affecting companies including Seagate and Snapchat through similar social engineering tactics targeting payroll departments.

Sources

Sources available to members: 1 source.