Manager on Call LLC Discloses Phishing-Driven W-2 Data Breach Affecting Five Individuals
Human resources consulting firm Manager on Call LLC reported a data breach on May 28, 2026, stemming from a sophisticated email phishing attack that exposed sensitive W-2 tax information of employees. The incident was disclosed to the attorneys general of New Hampshire and South Carolina on May 29, 2026, with five affected individuals identified four in New Hampshire and one in South Carolina.
The breach occurred when a threat actor used display name spoofing to impersonate Manager on Call CEO Cristina Heta, sending a fraudulent but urgent request to the company’s staff operations team. Believing the email was legitimate, contractors bypassed secure data transfer protocols and sent W-2 files directly to the attacker.
Exposed data included full names, home addresses, 2025 wage details, and Social Security numbers, heightening risks of tax fraud and identity theft for those impacted. The company confirmed that the breach was an isolated social engineering incident, with no compromise of its internal mail servers or client databases.
In response, Manager on Call is offering complimentary credit monitoring and identity theft restoration services through Experian to affected individuals. Notifications were sent on May 28, 2026, with a follow-up email containing enrollment details for the service. Those with questions can contact the CEO directly or reach the company via phone or email.
Source: https://www.claimdepot.com/data-breach/manager-on-call-2026
OnCall cybersecurity rating report: https://www.rankiteo.com/company/oncall-llc
"id": "ONC1780598011",
"linkid": "oncall-llc",
"type": "Breach",
"date": "5/2026",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '5',
'industry': 'Human Resources',
'location': 'United States',
'name': 'Manager on Call LLC',
'type': 'Human Resources Consulting Firm'}],
'attack_vector': 'Phishing (Display Name Spoofing)',
'customer_advisories': 'Affected individuals notified on May 28, 2026, with '
'follow-up emails for enrollment in credit monitoring '
'services',
'data_breach': {'number_of_records_exposed': '5',
'personally_identifiable_information': 'Full names, home '
'addresses, Social '
'Security numbers',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'W-2 tax information, personally '
'identifiable information (PII)'},
'date_publicly_disclosed': '2026-05-28',
'description': 'Human resources consulting firm Manager on Call LLC reported '
'a data breach stemming from a sophisticated email phishing '
'attack that exposed sensitive W-2 tax information of '
'employees. The breach occurred when a threat actor used '
"display name spoofing to impersonate the company's CEO, "
'leading to the exposure of full names, home addresses, 2025 '
'wage details, and Social Security numbers.',
'impact': {'data_compromised': 'W-2 tax information, full names, home '
'addresses, 2025 wage details, Social Security '
'numbers',
'identity_theft_risk': 'High'},
'initial_access_broker': {'entry_point': 'Phishing email (Display Name '
'Spoofing)'},
'post_incident_analysis': {'root_causes': 'Social engineering attack '
"exploiting trust in CEO's display "
'name; bypass of secure data '
'transfer protocols'},
'references': [{'source': 'Incident Disclosure to Attorneys General of New '
'Hampshire and South Carolina'}],
'regulatory_compliance': {'regulatory_notifications': 'Disclosed to attorneys '
'general of New '
'Hampshire and South '
'Carolina on May 29, '
'2026'},
'response': {'communication_strategy': 'Notifications sent to affected '
'individuals on May 28, 2026, with '
'follow-up emails for enrollment '
'details',
'remediation_measures': 'Offering complimentary credit '
'monitoring and identity theft '
'restoration services to affected '
'individuals',
'third_party_assistance': 'Experian (Credit Monitoring and '
'Identity Theft Restoration Services)'},
'title': 'Manager on Call LLC Phishing-Driven W-2 Data Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'Social Engineering'}