The IRS has established a process that will allow businesses and payroll service providers to quickly report any data losses related to the W2 scam currently making the rounds. See details at Form W2/SSN
Data Theft: Information for Businesses and Payroll Service Providers. If notified in time, the IRS can take steps to prevent employees from being victimized by identity thieves filing fraudulent returns in their names. There also is information about how to report receiving the scam email. https://www.irs.gov/individuals/form-w2-ssn-data-theft-information-for-businesses-and-payroll-service-providers.
As a reminder, tax professionals who experience a data breach also should quickly report the incident to the IRS. Tax professionals may contact their local stakeholder liaison. See details at Data Theft Information for Tax Professionals. https://www.irs.gov/individuals/data-theft-information-for-tax-profesionals.