BRADENTON (FOX 13) - The email looked official and it appeared to come from the Manatee County schools superintendent.
"It said, 'Forward all employee 2016 W-2 forms to me, attached and sent in a PDF. I would like to have them as soon as possible for board review,'" read Ron Ciranna, the district's superintendent of business services and operations.
But Ciranna says the email that was sent to the payroll department on January 26 was not really from superintendent, but rather by criminals. Now, the scam artists have the W-2 forms for all 7,700 district employees.
The victims were told about it Friday, and they've all been signed up for coverage by AllClear ID, an identity protection service.
"We are not here to find fault or put blame on any district employees, but rather to orchestrate a concentrated effort to find these criminals and do what we can," said Ciranna.
It's a race against time. It took a week for the district to realize it had been swindled. It's something scam artists are doing across the nation.
"It's just been an ongoing pattern with these guys. They have something that works. When you think about it from a hacker's perspective, once you have something that works, you will continue to use it on a broader and broader audience," said Serge Joregensen of Sylint.
Sylint, a cyber-security firm in Sarasota, deals with these sort of cases all the time. They are not involved in the school district investigation, but they tell FOX 13 the criminals will likely try to use the stolen W-2s to file fraudulent tax returns.
History suggests they have a good chance of succeeding.
Manatee School District has contacted the FBI and are working with the IRS. In the meantime, they will focus on education.
"We need to do more face to face, more telephone calls. Go to somebody's office, say 'excuse me I received this email for you; it doesn't sound like you. Can I provide you with some other information other than what you requested to still get you what you think you need,'" said Ciranna.
Security experts said that is good advice for every business or government agency.
"If you get an email that is really short from your boss that says, 'Hey I need this right away,' your inclination is to send it, not to check and make sure it's really your boss," Jorgensen added.