Cyber Incident Victim: Whiting-Turner
Date:
Mar 2016
Location:
United States of America
Summary
A cybersecurity incident involving a vendor used by Whiting-Turner for tax preparation services potentially compromised sensitive employee and dependent information. The vendor detected suspicious activity on its systems, coinciding with reports of fraudulent tax filings in employees' names. The affected data included employee names, Social Security numbers, wage details, and withholding information from W-2 forms, as well as minor and adult dependents' names, dates of birth, and Social Security numbers from healthcare-related 1095 forms. The company immediately restricted access to the vendor's systems and initiated an investigation, though unauthorized access to specific records remained unconfirmed at the time of notification.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 8, 2016, Whiting-Turner, a contracting company, was notified by an unnamed third-party vendor providing tax filing and information services that suspicious activity had been detected on the vendor’s systems. The vendor was responsible for preparing employee tax documents, including IRS Forms W-2 and 1095. Around the same time, Whiting-Turner received reports from multiple employees regarding fraudulent tax filings submitted in their names. In immediate response, Whiting-Turner disabled user access to the vendor’s systems and initiated an investigation to determine whether unauthorized individuals had accessed employee data. The company’s investigation remained ongoing at the time of its April 2016 notifications, with no definitive confirmation of whether Whiting-Turner-specific information had been compromised through the vendor’s systems.
The incident potentially exposed sensitive personal information of current, former, and retired employees, as well as their dependents. For employees who received a 2015 IRS Form W-2 through Whiting-Turner, the data at risk included names, Social Security numbers, wage information, and tax withholding details. For adult beneficiaries, adult dependents, and minor dependents covered under employee healthcare policies, the breach potentially compromised names, dates of birth, and Social Security numbers listed on 2015 IRS Form 1095. Whiting-Turner issued notifications to all potentially affected individuals, including separate letters to employees and parents/guardians of minor dependents, advising them of the incident and recommending vigilance against identity theft and fraud. The company emphasized its proactive measures to secure data by terminating vendor system access but did not disclose remediation steps beyond the investigation or identify the vendor involved.