Western employees became victims of a cyber attack recently, resulting in hackers gaining access to their Western login information.
Employees were sent an email titled, “Important message from WWU faculty/staff” which included a “Click here to read” link. Upon clicking the link, they were taken to a web page out of the country, almost identical to the Western’s login screen, Interim Chief Information Officer Greg Smith said in a mass email sent to employees.
Once employees entered their login and password, the hackers took over their accounts, redirecting their paychecks, Smith said.
“This sort of cyber attack which was highly organized is a national problem affecting many universities and colleges,” Smith said. “WWU IT Security disabled access to the malicious site soon after discovering the activity and protected a number of the compromised accounts, however a small number of employees did have their direct deposit pay rerouted to the criminals bank.”
“Keep an eye on the web browser address bar. Be cautious if the address changes unexpectedly, or if you click on a link and are taken to an unfamiliar address. Exercise caution if a message sounds or a website looks suspicious, is out of the ordinary or unexpected.”
Paul Cocke, director of communications and marketing
Human Resources is currently working with the IT Security office to implement changes to the direct deposit process, Smith said.
Western has systems in place that catch and block hundreds of malicious messages on a daily basis. However, they will never catch everything, Paul Cocke, Western’s director of communications and marketing, said in an email.
“This is why the second line of defense - our people - need to be constantly on the lookout, aware and cautious to assist in protecting our accounts and our systems,” Cocke said.
Western’s Information Security Office has some tips to avoid falling victim to phishing scams.
“Keep an eye on the web browser address bar. Be cautious if the address changes unexpectedly, or if you click on a link and are taken to an unfamiliar address,” Cocke said. “Exercise caution if a message sounds or a website looks suspicious, is out of the ordinary or unexpected.”
In addition, you should be skeptical of messages requesting personal or financial information and never use email to send this type of information. Western will never directly ask for personal information in an email message. However, some messages may include hyperlinks that require sign in to “eSign” or “OneDrive,” Cocke said.
As always, click with caution.
