Sham Email Campaign Exposes Employee Data at University of Virginia

Overseas hackers, who now are in custody, allegedly gained access to records for more than a thousand U-Va. personnel, including W-2 tax forms from 2013 and 2014.

The school disclosed the case on Jan. 22. 

The data breach involved the use of a “phishing” scheme, where the hackers sent emails to U-Va. staffers asking them to click on a link and provide their account log-in information and passwords. 

The hack affected staffers in the school’s academic division.

The FBI "recently notified" the school of a data exposure following an extensive law enforcement investigation," Patrick D. Hogan, U-Va. executive vice president and chief operating officer, said in a statement. "University officials are also aware that other colleges and universities were targeted by these perpetrators."

U-Va. officials said the breach is unrelated to one from last summer.