SEATTLE, Wash. - The Archdiocese of Seattle is warning thousands of employees and volunteers after hackers hit one of its databases.
The FBI and IRS are now investigating after thieves stole personal information and filed fake tax returns.
In scenarios such as this, the hackers steal names and Social Security numbers and redirect the refunds to themselves or associates.
The church said Monday that there are more than a dozen victims who found their tax returns were compromised.
"I hadn't heard anything about it," said Theresa Westlund, a parent at Holy Rosary School in West Seattle, when KIRO 7 informed her of the security breach.
Westlund volunteers frequently at the school, which means she could be a victim of the hackers.
"It's a little bit frustrating," she said.
In fact, the security breach could affect up to 90,000 employees and volunteers at churches, schools, and agencies within the archdiocese.
Greg Magnoni, director of communications at the archdiocese, said employees and volunteers all have to submit personal information, including social security numbers.
That information is stored in several databases, and the Archdiocese believes one of those databases was hacked.
"The bad guys have figured out how to breach it," Magnoni said, "and so it's unsettling."
Magnoni said they found out about the first fraud on Tuesday and immediately sent out a memo notifying employees. They also hired a security firm.
According to the IRS, in fiscal year 2013, the agency initiated nearly 1,500 identity theft-related criminal investigations, which is an increase of 66 percent over investigations in 2012.
"We realized it's a national scam," Magnoni said. "It's something that's been going on for several years, and that many organizations across the nation have been affected by this."
He said the archdiocese is aware of more than a dozen victims so far across the Chancery and several parishes.
He's urging people to call the IRS or go online to check their returns.
Magnoni said it's unclear yet whether the hackers succeeded in getting refunds.
Victims are advised to contact the IRS's Identity Protection Specialized Unit and report the theft to the Federal Trade Commission.
Check Your Return