MoneyTree Falls for SpearPhishing Scam

Employees of payday lending company Moneytree are used to taking the personal information of customers in exchange for short-term cash infusions. Some of those workers recently found themselves on the other side of the fence after someone at the company fell for the CEO email scam.

The company’s actually CEO and co-founder Dennis Bassford informed employees in early March – via email, no less – that their Social Security numbers, salary and address information had been shared with scammers.

“Moneytree was apparently targeted by a scam in which the scammer impersonated me and asked for an emailed copy of certain information about the company’s payroll including team member names, home addresses, Social Security numbers, birthdates and W2 information,” Bassford wrote to employees.

The scam affected both current and former Moneytree employees who worked at U.S. stores in 2015 or were hired in early 2016.

“The good news is that our servers and security systems were not breached, and our millions of customer records were not affected,” Bassford said in the email. “The bad news is that our Team Members’ information has been compromised.”

While a Moneytree employee confirmed the breach to Krebs on Security, she couldn’t provide an exact number of workers affected.

Moneytree apparently employs more than 1,200 employees, so while this might not be the largest breach in recent months, we’re sure that this is no consolation to the employees affected.

Moneytree joins Snapchat and Seagate, and others, in falling victim to the CEO email scam in recent months.