Data breach at Guilford-area schools leads to identity thefts

By Nick McCrea 
and Stuart Hedstrom
BDN/Observer Staff Writers

GUILFORD — A data breach in School Administrative District 4 has resulted in at least five employees dealing with false income tax returns filed in their name, according to the Piscataquis County Sheriff’s Department.

The district said anyone who received a W-2 from the district during the last filing period should take steps to protect their identities and determine whether their information was used to file fraudulent tax returns. The district includes Guilford, Abbot, Cambridge, Parkman, Sangerville and Wellington.

Late last month, the district’s payroll clerk received an email that appeared to have come from her boss, district Superintendent Ann C. Kirkpatrick. In the email, the sender asked, “please send me the list of W-2 copy of all employees wage and tax statement for 2015. Kindly prepare the report in PDF and send via email. Thanks, Ann C. Kirkpatrick”

The message appeared to come from the superintendent’s email address, and even included the same thumbnail image attached to every email she sends. The only indication that it was any different from any of her other emails were the words “via caldive.club,” which appeared in a small font next to her name.

Kirkpatrick, however, had nothing to do with the email.

The district employee responded, saying the report would be 339 pages, and asked, “Are you sure you want it” before sending along two attachments.

Those attached reports included information from the W2s of district employees but excluded Social Security numbers and birthdates.

The scammer followed up with an email stating “Please send a Copy of Employee Information (I.E.; Employee Name, Employee DOB and SSN if available).”

After that the employee grew suspicious and the district contacted police.

What remains unclear is how the scammer or scammers were able to use the information provided by the district to file fraudulent tax documents under the names of some employees without access to their Social Security numbers.

“That’s the big burning question out there,” Kirkpatrick said. “How did they connect that dot?”

Kirkpatrick speculated that the scammer somehow pulled Social Security numbers from another source.

SAD 4 isn’t the first district to be targeted by scammers this tax season. School officials in Brunswick reported a similar scam attempt around the same time. Brunswick administrators responded in much the same way as Guilford, providing initial documentation, but notifying police when the scammer posing as the superintendent requested Social Security numbers and dates of birth.

Deputy Guy E. Dow of the Piscataquis County Sheriff’s Office continues to investigate the breach. Dow said several employees filed police reports after going to file their taxes. The Maine Revenue Service also has sent letters to many SAD 4 employees notifying them that they may have been victims of identity theft.

Dow wrote an April 13 letter to district employees saying Maine Revenue Service asked any letter recipients who fell victim to identity theft to contact the sheriff’s office to file a criminal complaint. Dow said he contacted the Maine Revenue Service and the Maine attorney general’s office, with the Maine Revenue Service being able to trace refunded money and planning its own investigation. The attorney general’s office recommends SAD 4 employees conduct credit checks to determine if there are any unknown accounts in their names.

“We met with staff and we shared identity theft protocol and what to do and at that juncture people were sending out their tax returns and their preparers were saying ‘it’s already been sent,’” Kirkpatrick said.

“The SAD 4 Education Association is taking the data breach very seriously, and is concerned about members’ information being released to a hacker,” Misty O’Leary, UniServ director for the Maine Education Association, said in a recent email. “We will continue to investigate this issue; protecting the identity of our members and their families is of utmost concern. Teachers and support staff are troubled that this kind of data breach happened in the first place, and we are working to ensure it never happens again and hope proper security procedures are put into place in the future.”

Kirkpatrick said there was “panic, worry, and frustration” after the district learned of the scam, and that it could linger even after this tax season.

“Even if we’re safe this year, does that mean next year we’ll be safe?” she said.