VENTURA, Calif. -- Ventura County's online credit card payment system was apparently hacked from the Philippines, enabling scam emails to be sent to many residents who used the system to pay their 2007 property taxes, officials said this week.
Treasurer-Tax Collector Steven Hintz said the phishing emails appeared to be sent over the weekend in an effort to trick recipients into providing personal information, such as Social Security numbers, which can be used for identity theft. He advised residents not to open or reply to the emails, which falsely appear to be from the county.
"The hacker acquired a large number of emails from people who used the Epay-it.com system in 2007, then generated false emails to those addresses, which give the appearance of coming from the Ventura County web administrator," Hintz said.
The subject line of the email sent over the weekend is "ePay Confirmation of Internet Payment." The sending address is county.websitecoordinator(at)ventura.org, a valid county address, Hintz said.
The body of the email reads, "Your transaction has been Completed. If you have questions regarding this payment, contact the WebTax 2007 Office." And it provides a link.
Hintz said his office has been flooded with more than 1,400 emails and telephone calls, as well as "quite a few" in-person inquiries from concerned residents who have received the bogus email.
"It's been an avalanche," he said, noting he was one of the email's recipients himself after it got by his spam filter.
Hintz said his office has been telling residents that county information technology officials say no personal or financial taxpayer information was obtained by the hacker from the county's system.
"Because we don't retain any personal information when people make payments, the county IT people are positive that no personal information was compromised," he said.
Even so, Hintz advised anyone who received the email to check his or her financial accounts for any irregularities.
Thus far, he said, he has received no reports of any such irregularities.
He said he checked his own bank and credit card accounts after receiving the email, but found nothing out of order.
Hintz said county information technology workers learned over the weekend that the county's Epay-it.com system had been hacked, but have since blocked the intruder from any further access.
County Chief Information Officer Rick Jackson "said that the hole that allowed this guy to get in has been fixed, and that they are reviewing the rest of the system to make sure there are no other vulnerabilities," Hintz said.
Jackson could not be reached for comment.
Roger Ruhle of Oak Park, Calif., received the scam email Saturday. He was not convinced the hacker or hackers had not gleaned any personal or financial information beyond his email address.
"It is absolutely a phishing email," he said. "On the other hand, anybody that paid by credit card, they (the hacker or hackers) have that information."
Camarillo resident Bill Moody received the email Sunday and thought it referred to his current property taxes.
"And so I immediately went online to check to see if maybe they took my property taxes out of my account," said Moody, 57, who runs a Simi Valley title insurance company. "But they hadn't been paid because they're not due for a couple of weeks."
Mike Harris is a reporter for the Ventura County Star in California.