Hacker accesses personal information of nearly 3,000 Amalgamated Sugar employees

A worker at Nampa’s Amalgamated Sugar plant monitors a water-borne flume of beets freshly delivered by train in 2014.
A worker at Nampa’s Amalgamated Sugar plant monitors a water-borne flume of beets freshly delivered by train in 2014.

A hacker has accessed all of the personal information contained on W2 tax forms of employees of Boise-based Amalgamated Sugar, the company said Friday.

The hack yielded tax forms for 2,858 employees, including seasonal workers and employees who retired in 2016.

The company said it employs between 1,200 and 1,500 full-time workers, including 574 at its plant and offices in Nampa, and it hires hundreds of seasonal workers each fall. It also employs people at plants in Twin Falls and Paul.

On Wednesday, a hacker mimicked the email address used by CEO John McCreedy to send a phishing email to a corporate employee seeking copies of the tax forms, the company said in a news release. The hack yielded names, addresses, earned wages and Social Security numbers.

The company said it learned of the hack within hours, identified its source and worked with employees to control communications. Within 24 hours, it notified law enforcement, the Idaho Attorney General’s Office, the Idaho Tax Commission, the FBI and the IRS.

Amalgamated said it notified employees of the breach via email and workplace meetings. The company also bought subscriptions for employees to LifeLock, which monitors and flags suspicious transactions. No employees reported problems, but the company urged workers to monitor their accounts and place fraud alerts with credit-reporting agencies.

“We deeply regret this incident and want to extend our apologies and espress our concern to everyone affected,” McCreedy said.

So far, there is no evidence that any of the information has been used, the company said.

Amalgamated said it is reviewing its information-security policies and procedures to reduce the risk of additional cybersecurity problems.

“We take the security of our employees’ personal information very seriously, and we are examining our existing protocols and putting controls in place to prevent this from happening again,” McCreedy said.

The Amalgamated Sugar Co. LLC produces sugar from beets grown by more than 750 members of its parent cooperative, the Snake River Sugar Co. It is the second-largest U.S. maker of sugar from beets.

Zach Kyle: 208-377-6464, @ZachKyleNews