"Scary" is the word many are using after it was revealed that a couple emails helped give scammers access to thousands of W2 forms.
Last week someone posing as the Groton School District's Superintendent asked for the information via email. Then a few days later, NBC Connecticut was first to report that the same thing happened at Glastonbury.
In both districts, employees fell victim to the phishing scam, affecting nearly 3,000 people.
But those were not the only districts targeted.
Joe Cirasuolo, the Executive Director for the Connecticut Association of Public School Superintendents, or CAPSS, says in the last seven days Wallingford, Killingly, and Milford received a similar email, but all three realized it was a scam and sent nothing.
On Monday, CAPSS sent a warning out about the scam and recommended superintendents alert staff of the scam if they hadn't already.
"The advice has been to anybody who gets this kind of message, check with the person who was supposed to have sent it and find out if it is legitimate," said Cirasuolo. He adds that if it's determined to be a phishing scam, to contact authorities.
Local
In Wallingford's case, the phishing email never received a reply because the superintendent says they notified staff more than a month ago that the scam was out there.
Cyber security is a growing concern for many organizations and school districts are no exception.
"It's a concern, and I think it's something we'll be responding to," said Cirasuolo.
Cirasuolo says they're considering creating training programs to help superintendents and staff prevent data breaches.
