Twinsburg mistakenly released W-2 data for about 500 current and former city workers as part of an email tax return scam.
Up to 50 workers already have had fraudulent tax returns filed in their names.
The city is offering identity theft protection services to the employees, as local police and the IRS investigate the crime.
“We’re tremendously sorry for our employees that this happened,” Mayor Ted Yates said Monday. “We go to great lengths to protect our information.”
The IRS announced earlier this month that the W-2 email scam had extended from corporations to school districts, hospitals, restaurants, tribal organizations and nonprofits.
“This is one of the most dangerous email phishing scams we’ve seen in a long time,” IRS Commissioner John Koskinen said at the time. “It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns.”
The IRS estimated that during the 2013 filing season, more than 5 million tax returns were filed using stolen identities, claiming about $30 billion in refunds.
A Twinsburg worker received an email Feb. 3 that was disguised so that it looked like it came from the city finance director. The worker responded with a file containing W-2 information for employees.
Yates said the city immediately alerted employees and the IRS. The federal agency has flagged the city’s tax identification number as part of the investigation.
The city also has encouraged workers to file their tax returns as soon as possible electronically because once a return is filed no one else can file, the mayor said.
“Hopefully we’ve done everything we can do to protect our employees,” he said.
Police couldn’t immediately be reached for comment.
Rick Armon can be reached at 330-996-3569 or rarmon@thebeaconjournal.com. Follow him on Twitter at @armonrickABJ .