Canadian University Hit For $12m Phishing Scam

MacEwan University said its IT systems are secure after the institution was defrauded of nearly $12 million in a phishing scam compounded by human error.

The university learned it was the victim of an attack last Wednesday, Aug. 23 after a series of fraudulent emails “convinced university staff to change electronic banking information for one of the university’s major vendors.”

The fraud led university staff members to transfer $11.8 million to a bank account they believed belonged to the vendor, the university said.

MacEwan University spokesperson David Beharry said three relatively low-level staff members were involved in the transfer. He said there was no process in place which required staff members to phone the vendor to confirm the request to change banking information, but that will change.

“We are looking at the levels of staffing it must go through for authorisation before somebody changes that,” he said. “There is going to be a secondary and tertiary level of approval before this goes on.

Beharry said three separate payments, ranging from $22,000 to $9.9 million, were made to the vendor between Aug. 10 and Aug. 19. He said he has not been given permission to release the vendor’s name, but said the company is local.

“What we were able to find out is, there were approximately 14 construction firms in the Edmonton area that were targeted,” Beharry said.

“The fraudsters produced these fake domains about these 14 organizations. The organisations would not have any knowledge that somebody is phishing.”

Beharry said all personal and financial information, and all transactions made with the university, are secure.

More than $11.4 million of the money has been traced to accounts in Canada and Hong Kong. The university said the funds have been frozen while it works with lawyers in an attempt to recover the money.

Beharry said the university is confident it will get the money back.

The rest of the money is still missing. Beharry admitted this “shouldn’t have happened in the first place.”

“I think twice about this, too, and I go, ‘How?'” And that’s why we need to fully investigate, because we need to get to the bottom of this to make sure it doesn’t happen again,” he said.

“I think it’s safe to say that there was a lot of disappointment and frustration. Because this came down to human error.”

The president of Kick Point, an Edmonton digital marketing and web design agency, said she was “flabbergasted” when she heard about what happened at MacEwan.

“I’m really shocked that an institution this large could be taken by a scam like this and in such a large amount,” Dana DiTomaso said.

She said there’s a perception that phishing scams mainly target personal information, like credit card and password information, but they also affect businesses.

“I think it’s more common than people let on because it doesn’t necessarily get the same kind of attention,” she said. “If a business loses a bunch of money, they’re either a private business and they don’t want to talk about it because it’s embarrassing, or they’re a public business and they have to talk about it but they don’t really want to.

“You don’t hear about the volume of issues that come up on a day-to-day basis.”

The most important advice she can give to anyone in a situation like this is to think twice.

“Think twice before you transfer a bunch of money to somebody else. If it seems iffy, if someone is asking you to do something different than what you would normally do, which is the case here or what seems to be the case here, then check in with somebody else, check in with a bunch of people.”

After the fraud was discovered, MacEwan conducted an audit of university business processes. Officials said “controls were put in place” to prevent similar incidents from happening.

Beharry said the university provides information to its staff, students and faculty about these types of scams and other cyber-security related issues. He said it’s important that the university reinforce its messaging.

External experts have been brought in to help the university in its investigation. The university said preliminary investigations reveal that controls in place around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed.

MacEwan University said final results of the review are expected within a few weeks.

The minister of advanced education and the officer of the auditor general have been made aware of the situation.

Advanced Education Minister Marlin Schmidt said he’s “very disappointed” the university fell victim to the crime, adding he’s instructed all university board chairs to review their financial controls.

“This is unacceptable and I’ve asked the board chair to report back to me by Sept. 15 with details on how this occurred,” Schmidt said in a statement.

“While I’m told that MacEwan has put improved internal financial controls to help prevent it from happening again, I expect post-secondary institutions to do better to protect public dollars against fraud.”

Beharry said it’s too early to say whether the staff members will be disciplined.

Global News:

You Might Also Read: 

The Insider Threat:

Employees That Cause Data Breaches:

 

« WikiLeaks: The Biter Bit
Wearable Sensor Tech For Beat Police Officers »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

MarQuest

MarQuest

MarQuest provides services and systems to enhance network reliability and security.

Chubb

Chubb

Chubb is the world’s largest publicly traded property and casualty insurer. Commercial services include Cyber Risk insurance.

Advenica

Advenica

Advenica develops, manufactures and sells innovative cybersecurity solutions for encryption and secure information exchange.

Cybersecurity Association of Maryland (CAMI)

Cybersecurity Association of Maryland (CAMI)

CAMI’s mission is to create a global cybersecurity marketplace in Maryland and generate thousands of high-pay jobs through the cybersecurity industry.

IronNet Cybersecurity

IronNet Cybersecurity

IronNet’s product and services provide enterprise-wide security management and visibility of your network, users and assets.

International Cybersecurity Forum (FIC)

International Cybersecurity Forum (FIC)

The International Cybersecurity Forum (FIC) has established itself as the benchmark event in Europe in terms of digital security and trust.

Cloud Box Technologies

Cloud Box Technologies

Cloud Box Technologies is one of the premier IT Infrastructure Solution providers in the Middle East.

comforte AG

comforte AG

comforte AG is a leading provider of data-centric security technology. Organizations worldwide rely on our tokenization and format-preserving encryption capabilities to secure personal, sensitive data

Ampyx Cyber

Ampyx Cyber

Ampyx Cyber (formerly Ampere Industrial Security) is an industrial security firm. We specialize in industrial control systems (ICS) and operational technology (OT) security.

Condition Zebra

Condition Zebra

Condition Zebra has wide experience in providing IT Security Services, Training, and Certification in the field of cybersecurity.

BlueSteel Cybersecurity

BlueSteel Cybersecurity

BlueSteel is a compliance consulting firm that leverages deep system, data and application expertise to build sustainable cybersecurity solutions.

Concorde Technology Group

Concorde Technology Group

Concorde Technology Group is one of the UK’s leading IT support and services providers, delivering cost-effective and innovative IT solutions to businesses across the country.

CyAmast

CyAmast

CyAmast is an IoT Network security and analytics company that is changing the way enterprise and governments detect and protect networks from the pervasive threat of cyber attacks.

ACDS (Advanced Cyber Defence Systems)

ACDS (Advanced Cyber Defence Systems)

ACDS was founded in the belief that cyber security can be done better. We’re combining emerging technologies and proven methods to bring a new approach to tackling the growing threat landscape.

SSL2BUY

SSL2BUY

SSL2BUY is a leading SSL certificate provider, authorized to sell top CA brands like Comodo, DigiCert, GlobalSign, Thawte, GeoTrust and more.

NSI Global

NSI Global

NSI Global is a specialist Global Risk and Intelligence Advisory Firm. We specialise in Risk Consulting, Security Intelligence, Geopolitical Intelligence, Cyber Security, Digital Forensics, and TSCM.