Why did an NBA team hand over every employee's tax forms to a scammer?

In May 2016, the Milwaukee Bucks NBA team handed over every employee's 2015 tax forms to a criminal, and no firewall was broken to make it happen. Someone simply sent an email pretending to be team president Peter Feigin and asked for the documents, and the forms were handed over. The team was fooled by a person, not beaten by a machine.

This kind of attack is called social engineering: tricking a person into giving up secrets or access, rather than breaking into a computer system directly. It works by exploiting trust and the mental shortcuts people rely on every day, especially urgency from someone who appears to be a boss. A common version targets finance and accounting staff with emails impersonating the CEO and demanding quick action, a scheme known as business email compromise. In early 2016 the FBI reported that these scams had cost US businesses more than $2 billion in about two years.

Such scams are closely related to a trick called spoofing: faking data like an email's sender address so a message looks like it's coming from someone trustworthy. Cybersecurity, the broader field protecting computer systems and data from this kind of threat, defines a vulnerability as any flaw that weakens a system's security, and a threat actor as whoever exploits it, whether through clever code or, as with the Bucks, through a well-worded email.

The lesson is a humbling one for a field often associated with passwords and encryption: the weakest point can be human trust. And attacks are common: a 2023 UK government survey found that 69 percent of large businesses recalled a breach or attack in the previous twelve months.