Vermont Business Magazine According to a statement released Monday by the Town of Essex, on April 7 & 8, 2016, an unknown person sent fraudulent emails to the Town of Essex, pretending to be an Essex Town Official. This email requested payroll records for all Essex Town personnel. Mistakenly, town staff did not confirm the identity of the sender and sent the requested payroll records in response to the fraudulent emails. On April 12, 2016, the Town discovered this fraud when several Town employees tried to file their taxes and found their accounts had been compromised. On April 13, 2016 the Town confirmed that the suspect emails were indeed fraudulent and that the records provided contained PII (personally identifying information) of 262 current and past staff members.
Information released were copies of Essex Town 2015 W2’s, employee phone numbers, date of hire, date of birth and rate of pay information. This incident does not include any data for staff of the Village of Essex Junction. No information for Town/Village residents (except past/current staff) was released. Released information did not include any banking/credit card or bank routing information. No spouse/partner/dependent information was release unless they were past/present employees of the Town of Essex.
Town officials notified the Essex Police on April 12, 2016 (Police Case #16ES01880) and the Vermont Attorney General’s Office on April 13, 2016. The Town notified all affected staff (email/US Mail) of this data breach and is providing steps & information they should take to prevent identify theft. The Town will be updating policies, procedures and training on proper storage, use and transmission of PII for all employees who handle PII in their jobs.
Due to the fact that this is an on-going criminal investigation no further details about this breach are available at this time.