EDMONTON, ALTA. — Edmonton’s MacEwan University has lost millions of dollars after school staff unknowingly altered payment information in an online scam.
Last month the school discovered it had been the victim of a phishing attack.
According to a release on the school’s website, a series of fraudulent emails convinced university staff to change electronic banking information for Clark Builders, one of the university’s major vendors.
The fraud resulted in the transfer of $11.8 million to a bank account that staff believed belonged to the vendor.
The school stated the total financial loss won’t be clear until the investigation wraps up, but more than $11.4 million of the funds has been traced to accounts in Canada and Hong Kong.
The funds have been frozen and the university is working with legal counsel in Montreal, London and Hong Kong to pursue civil action in order to recover the money. According to MacEwan, the status of the balance of the funds is unknown at this time.
"There is never a good time for something like this to happen," said university spokesman David Beharry in a press release. "But as our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident. Personal and financial information and all transactions made with the university are secure. We also want to emphasize that we are working to ensure that this incident will not impact our academic or business operations in any way."
The Edmonton Police Service, law-enforcement agencies in Montreal and Hong Kong, and corporate security units of banks involved with the e-transfers are working together on the case.
According to school officials, an interim audit of business processes and controls were put in place to prevent further incidents after the fraud was discovered.
The school is waiting until the investigation is over to decide on more permanent changes to its business processes.
According to the school’s internal audit team, preliminary assessment has determined that controls around the process of changing vendor banking information were inadequate and that several opportunities to catch the phishing scam were missed. The school anticipates its audit to reach its conclusions in several weeks.
Key stakeholders have been advised of the incident and MacEwan has informed both the minister of advanced education and the office of the auditor general about the situation.
In the release, school officials said they would not be making any further statements on the incident to protect the integrity of the investigation.
According to various media reports, Clark Builders has been in touch with its clients, subtrades and suppliers to notify them of the situation.
The construction company has worked on numerous projects for the university. On the company website, it highlights the MacEwan University Service Centre and student residence projects.
Recent Comments
comments for this post are closed