Some Batavia city employees' personal data stolen in spoofing attack

A thief has obtained personal information about some City of Batavia employees and aldermen, including their Social Security numbers, in a security breach Wednesday.

"We are devastated, embarrassed and remorseful that this security incident occurred," City Administrator Laura Newman wrote in a letter to the current and former employees.

Someone sent an email, designed to look like it was from Newman, to an employee. It asked the worker to supply W-2 information. The employee, not realizing it was fake, did so.

The breach has been reported to police. The city has also notified the IRS and the Illinois Department of Revenue that someone may try to file fraudulent tax returns using the information, which included the employees' names, addresses and wages. The agencies have placed flags on the victims' accounts, and they may be required to provide additional proof of identification when they file their returns.

The city is also providing the victims with a year of free credit monitoring and identification theft protection services.

The IRS issued an alert to employers in February 2017 that in some business-email compromise cases, a fake email that seems to be from a boss is sent to someone in a personnel or finance department, requesting the receiver send the boss employees' W-2 form information. It said the W-2 scam started appearing in 2016.