While there have certainly been stories widely reported in the news that turned out to be untrue, this doesn't read like one of them. The key is the entry on the Verizon security blog. Whereas 'urban legend' stories are usually short on specifics, and often cite unnamed 'friends of friends', the Verizon report claims that it was actually them who dealt with this incident. It is entirely understandable that they don't name either the person or the company. Given the widespread attention given this story it is highly likely that Verizon would have taken this story down if it had been a prank or an early April Fool.
The poster is named (another thing that tends not to happen with urban legends) and exists and is a security professional according to this and this. He claims that he has personal knowledge of the incident - something that would probably get him fired if Verizon knew he was lying. According to several reports he spoke to ABC News about it. Some reports have details that are not in the original security blog.
All in all I see no reason to doubt the truth of this.