A Canadian University Gave $11 Million to a Scammer
Credit to Author: Jordan Pearson| Date: Thu, 31 Aug 2017 20:06:58 +0000
A Canadian university transferred more than $11 million CAD (around $9 million USD) to a scammer that university staff believed to be a vendor in a phishing attack, a university statement published on Thursday states.
Staff at MacEwan University in Edmonton, Alberta became aware of the fraud on Wednesday, August 23, the statement says. According to the university, the attacker sent a series of emails that convinced staff to change payment details for a vendor, and that these changes resulted in the transfer of $11.8 million CAD into bank accounts that the school has traced to Canada and Hong Kong. The school is working with authorities in Edmonton, Montreal, London, and Hong Kong, the statement reads.
Read More: How a Clever Hacker Tricked a Major Bitcoin Company Out of $1.8 Million
According to the university, its IT systems were not compromised and no personal or financial information was stolen. A phishing scam is not technically a “hack,” it should be noted, and only requires the attacker to convince the victim to send money.
The school’s preliminary investigation found that “controls around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed.”
Details beyond those included in the statement are scarce, but Motherboard reached out to the university for comment and will update when we hear back.
“There is never a good time for something like this to happen,” university spokesman David Beharry said in a statement, “but as our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident. Personal and financial information, and all transactions made with the university are secure. We also want to emphasize that we are working to ensure that this incident will not impact our academic or business operations in any way.”
The full details of the investigation should be available in the coming weeks, the university statement says.
Get six of our favorite Motherboard stories every day by signing up for our newsletter.