Thousands Threatened By Academy Of Art Email Spoof

SAN FRANCISCO (CBS SF) -- Three thousand employees with the Academy of Art are scrambling to find out if their financial and credit information has been compromised in the wake of a sophisticated email spoof.

On March 4th, someone in the Academy of Art human resources department received an e-mail purporting to be from a senior executive with the Academy demanding the W-2's of every single employee. The e-mail address looked legit, but it wasn't. It had been spoofed.

"We are dealing with a very sophisticated, international Internet fraud and we are doing everything we can," said Rebecca Delgado Rottman of the Academy of Art.

The W-2 snafu wasn't detected until April 5th, that's when the Internal Revenue Service told an Academy of Art employee who tried to file their taxes – that someone else already had.

"Someone should have looked at the letter closely. People who deal with sensitive information should have training in this day and age," Dave Stoelk, a four-year Academy instructor told KPIX 5.

Stoelk signed up for the two years of free credit monitoring the Academy offered in the wake of the breach, but he filed his taxes on March 20th and doesn't know if his return is already in a criminal's hands.

"No one will know for sure until my tax return is supposed to comeback," he said. "So, Experian doesn't even know. There's a lag time."

The Academy of Art is working with the FBI to trace the source of the data breach and the criminal masterminds behind it.