27K UPMC workers hit by data breach, 788 by fraud

PITTSBURGH (AP) — The personal information of 27,000 University of Pittsburgh Medical Center employees might have been put at risk by identity thieves who apparently used the information of 788 workers to file bogus federal tax returns, the hospital network said.

UPMC notes that no patient information has been lost to the thieves, who are being investigated by the Internal Revenue Service and other federal agencies but have yet to be charged.

“This complex investigation is ongoing and we have had outstanding interagency cooperation,” U.S. Attorney David Hickton, the lead federal prosecutor for western Pennsylvania, said today.

When UPMC first confirmed the identity thefts in February, officials believed just 22 workers’ personal information was used to file bogus tax returns. The hospital network, which has 62,000 employees, later said more than 300 workers had been victimized.

UPMC’s latest announcement, on Thursday, was no surprise to Michael Kraemer, an attorney who has filed a lawsuit seeking class-action status on behalf of workers who have had bogus bank accounts opened and tax returns filed in their name.

“That’s what we’ve been saying all along,” Kraemer said about the thousands of employees potentially affected.