Payroll software hack impacts employees at Harvey Mudd
The payroll accounts for more than 100 Harvey Mudd College employees were accessed “without authorization” in early March, according to a statement from the college.
The breach was centered on the college’s UltiPro account, a contracted payroll provider software made by Ultimate Software, according to Director of Public Relations Judy Augsburger.
“Based on our investigation to-date, we believe that the UltiPro accounts for 107 current and past employees of Harvey Mudd College were accessed without authorization between March 3 and March 4, 2016,” Ms. Augsburger said in the statement.
“We have notified all Harvey Mudd College employees, including those whose data was not impacted, to inform them of the situation, to provide additional details, and to offer credit monitoring and protection services free of charge,” Ms. Augsburger said. “We continue to work with all employees to provide assistance and support.”
When reached for comment on the breach, Ms. Augsburger said in an email that the college had nothing to add beyond the statement provided.
At least one affected HMC employee filed a report with the Claremont Police Department alleging that a tax return had been filed using their personal information, according to Lt. Mike Ciszek.
“The way that [the suspects] did it, they were pretty sophisticated in covering their tracks,” Lt. Ciszek said. “So to find it, it’s going to be tough.”
Lt. Ciszek noted the suspects used vanishing IP addresses and spoofed IP addresses in order to access the account without leaving any digital fingerprints.
The tax fraud incident is similar to a previous incident last week, where the IRS notified at least eight Pomona College employees that tax returns had been previously filed in their name. In some cases, the employees received the notification when they were electronically filing their tax returns, according to a March 21 email from Pomona College Vice President and Treasurer Karen Sisson.
Both Ms. Augsburger and Ms. Sisson said the breach at HMC was not related to the incident at Pomona College.
“Harvey Mudd College accesses UltiPro differently from the other Claremont Colleges, and we have no evidence that employees from any of the other Claremont Colleges were affected by this incident,” Ms. Augsburger said.
The investigation is ongoing. Anyone with information is urged to contact the Claremont Police Department at (909) 399-5411.