Newsroom

Payroll services provider ADP was targeted by identity thieves, who stole salary and tax data after certain companies mistakenly published their ADP account information online.

The hackers used the published account information to set up ADP accounts in the names of the companies' employees, which then allowed them to steal those employees' tax and salary data.

KrebsOnSecurity reported that the breach includes employee data from U.S. Bancorp, the fifth-largest commercial bank in the country. The bank has reportedly been investigating the incident since April 19.

"ADP emphasized that the fraudsters needed to have the victim's personal data — including name, date of birth and Social Security number — to successfully create an account in someone's name," Krebs said. "ADP also stressed that this personal data did not come from its systems, and that thieves appeared to already possess that data when they created the unauthorized accounts at ADP's portal."

Krebs also noted that W-2 data is especially attractive to identity thieves because they can use it to fraudulently request tax refunds from the IRS.