The City of Keokuk said a data breach on Jan. 30 resulted in the release of personal information of current and former city employees and elected leaders. The city said it is working with law enforcement to determine who is behind the breach.
The city said in a statement that an unauthorized party was able to obtain 2017 W-2 tax forms through the use of a “criminal phishing email.”
It did not provide details about the email, nor did it identify the recipient of the email.
The city said no credit card or bank account information was compromised and the breach did not affect employees hired this calendar year. Affected employees will be notified via U.S. Mail and offered credit monitoring and identity theft protection services.
City Administrator Aaron Burnett said the Keokuk Police Department is working with federal authorities, but at this point, a suspect has not been identified.
The statement from the city is below.
[The] City of Keokuk takes the privacy and security of personal information entrusted to it very seriously. On January 30, 2018 we discovered that earlier that day, as a result of a criminal phishing email, an unauthorized party obtained an electronic file containing 2017 Form W-2s of certain current and former employees and elected officials.
Upon learning of the incident, we commenced a prompt and thorough investigation and the incident was reported to law enforcement; however, at this time, no suspect has been identified. We have confirmed that the information obtained by the unauthorized party included only 2017 Form W-2s of employees and elected officials. No credit card or bank account information was involved. Employees hired in 2018 are not impacted by this incident.
We will be providing written notice, via U.S. Mail, to those impacted and we will be offering them credit monitoring and identity theft protection services.
Please know that we take this situation very seriously. The privacy and security of personal information is of utmost importance to City of Keokuk, and we will continue to take significant measures to protect that information.
