The scammers were able to access W-2 forms with sensitive information after they asked employees to provide usernames and passwords. They also gained direct deposit banking information for 40 employees from 2013 and 2014. UVA is offering one year of credit monitoring and identity protection services to those affected.