Employees of payday lending company Moneytree are used to taking the personal information of customers in exchange for short-term cash infusions. Some of those workers recently found themselves on the other side of the fence after someone at the company fell for the CEO email scam. 

The company’s actually CEO and co-founder Dennis Bassford informed employees in early March — via email, no less — that their Social Security numbers, salary and address information had been shared with scammers, Krebs on Security reported Wednesday.

“Moneytree was apparently targeted by a scam in which the scammer impersonated me and asked for an emailed copy of certain information about the company’s payroll including team member names, home addresses, Social Security numbers, birthdates and W2 information,” Bassford wrote to employees.

The scam affected both current and former Moneytree employees who worked at U.S. stores in 2015 or were hired in early 2016.

“The good news is that our servers and security systems were not breached, and our millions of customer records were not affected,” Bassford said in the email. “The bad news is that our Team Members’ information has been compromised.”

While a Moneytree employee confirmed the breach to Krebs on Security, she couldn’t provide an exact number of workers affected.

Moneytree joins Snapchat and Seagate, and probably others, in falling victim to the CEO email scam in recent months.

Thieves Phish Moneytree Employee Tax Data [Krebs on Security]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.