Paycor paycor.com Paycor data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
On February 16, 2018, a Paycor employee mailed an encrypted disc of W-2 images to the wrong Paycor client. The images held names, mailing addresses and Social Security numbers. Paycor said one person viewed some of the file and it was returned. It offered a year of identity theft protection.
View all 13,118 breaches- Breach date
- 16 Feb 2018
- Made public
- 26 Mar 2018
- Data exposed
- Names, Physical addresses, Social security numbers
- Last updated
What happened
Paycor, a payroll provider, says a Paycor employee accidentally mailed an encrypted disc containing images of IRS W-2 tax forms. The forms belonged to employees of one of its clients, Supreme Corporation and its affiliates. The disc went to a single person at a different Paycor client company on February 16, 2018. The password came by separate email.
Paycor learned of it on February 22, 2018, when the recipient reported that the disc held another company's employees. The recipient had only spot-checked some entries. According to Paycor's notice letter, the disc was returned, the recipient deleted the data, and only that one person viewed the file.
Sources checked: oag.ca.gov, annualcreditreport.com, identitytheft.gov
Last verified against the official page:
What was exposed
The W-2 images show each person's first and last name, mailing address and Social Security number. The notice doesn't give a total count.
What it lets criminals do
A name, address and Social Security number together are what identity thieves need to open credit or file a false tax return. Paycor's investigation found a very low risk of misuse because one known person had the data and returned it. Some states require a letter anyway, so Paycor sent one with a year of identity theft protection through Experian. Employees in states that rely on a risk of harm test did not get this letter.
Paycor's response
Paycor retrained the employee and added quality assurance checks to how it creates discs. If your employer used Paycor in 2018 and you got this letter, it's the one that applies to you.
What to do if you were in it
- 1
Claim the identity protection offer
If you got the letter, the Experian offer is free for one year from the date on it. Follow the steps in the letter.
- 2
Freeze your credit at all three bureaus
A freeze is free and stops most new accounts in your name. Place it separately at Equifax, Experian and TransUnion.
- 3
Check your credit reports
Get your free reports at annualcreditreport.com and look for accounts you don't recognize.
- 4
File your taxes early
A W-2 holds what's needed for a fake return. Filing early makes that harder. Report misuse at IdentityTheft.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number and shows which leaks they appear in.
Official filings
- California Attorney General , filed 26 Mar 2018
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Paycor data breach?
The notice covers employees of Supreme Corporation and its affiliates. Paycor mailed letters to those people, so if you didn't get one, this notice probably doesn't concern you.
What was exposed in the Paycor breach?
Images of W-2 forms with names, mailing addresses and Social Security numbers.
Was the data stolen?
Paycor says it was a mailing mistake, not a hack. It says the disc was returned and only one person viewed the file.
Should I freeze my credit?
It's a sensible step if you got the letter, since your Social Security number was in the file. A freeze is free.
Sources
- oag.ca.gov/system/files/Supreme%20Corporation%20Notice%20Letter%20-%20CA_0.pdf
- Search Data Security Breaches | State of California - Department of Justice · oag.ca.gov
- Annual Credit Report · annualcreditreport.com
- IdentityTheft.gov · identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
