By: Ryan B Chan
Feb 24. 2022.
Conestoga College has recovered from a phishing email attack that targeted the student body and faculty.
At 3:21 PM on Feb. 4, Conestoga College’s Cyber Security team announced that a phishing email was sent to some of the email addresses that are associated with the college.
“Several Conestoga accounts were compromised through a phishing campaign. That access was leveraged by the malicious actor to gain further email lists,” said Curtis Preiss, Cyber Security Specialist at Conestoga College.
The Cyber Security team at Conestoga addressed the issue by “identifying compromised accounts and performing remediation actions on the accounts,” said Preiss.
The team removed phishing messages from Conestoga systems where applicable. Several sources were identified for the malicious activity and were prevented from accessing Conestoga systems.
The initial response email sent to the student body encouraged students and staff not to interact with any message with the subject line “COIN-BASED ATM SURVEY OPENING” or “Sophie Gaur Academic Evaluation.”
Example of the email provided by Curtis Preiss.
Cyber Security experts also warn that if this password has been previously used then you should change that password on all other accounts immediately.
According to CISCO’s 2021 Cybersecurity threat trends, Phishing attacks are 90 per cent of all data breaches.
The top three targeted types of data that are compromised in a phishing attack are credentials (passwords, usernames, PINs), personal data (name address, email address), and medical information (treatment information, insurance claims).
“Once the malicious actor has gained access to your account, they may not use it right away or they could move to the next stage of their attack to go after financial access, social media accounts, use the account to threaten others, or threaten you with permanent deletion of your data and information if you don’t pay them,” said Preiss.
This happened to David MacBride and his company in Mississauga, Ontario when an employee had clicked a suspicious link and downloaded malware onto the company’s systems.
“It’s completely crippling. The company still has the same costs occurred, but you’re absolutely zero productive,” said MacBride in a previous interview.
Cyber Security awareness and training are paramount for all users of modern technologies. Conestoga College Cyber Security highly suggests that all students take the training provided by the Canadian Centre for Cyber Security located here.
The Conestoga College Cyber Security team cannot make any comments on how many emails were sent out because of their internal security protection guidelines.
Preiss’s guidance for compromised accounts.
- Cyber Security recommends immediately changing your password. Help can be found here.
- Ensuring that your account is protected with Multi-Factor Authentication is also important. More information here.
- He also recommends reviewing any account activity here, and signing out of active sessions by using the “Lost Device?” function as shown in the screenshot below:
- If you are unsure if a message is a spam or phishing, forward a copy of the message to Spam@conestogac.on.ca and you will be emailed with instructions on how to proceed.
TIPS FROM PREISS ON SCAM IDENTIFICATION
Pay attention :
- The content of the email
- Bold or emphasized words
- Asking for personal contact
- Asking for personal information
- Mixing website or domains
