The phish attack obtained banking details

Three Wichita State University employees fell prey to a common phish attack asking for their credentials, giving cybercriminals access to change banking details.

We’ve said it time and time again: the cybercriminals do their homework. In the case of the attack on WSU employees, cybercriminals spoofed the university’s payroll system and sent emails to employees tricking them into providing their university ID and password. That was all the attackers needed to gain full control to the employee’s profile, personal data, and most importantly – banking information.

Where’s my paycheck?

It wasn’t until a number of employees did not receive their paychecks that the scam was found out. At least three members of the WSU staff fell for the scam, allowing cybercriminals to alter the employee’s personal banking details which caused paycheck payments to be routed to the criminals’ bank.

The university implied that they would make the employee whole, despite not being responsible for the attack, but indicated that they would not be able to do so in the future should it happen again.

Cybercriminals are in the business of ensuring their efforts pay off. It’s the primary reason they target specific industries, businesses, and even people. The more context they can gather (e.g., the payroll system used specifically by WSU), the higher the chances of successfully fooling an employee into taking the bait.

Security awareness training could have prevented this

Organizations need to elevate the security-mindedness of employees to avoid incidents like this. When users undergo Security Awareness Training, they are taught about the attacks methods used, and to be suspicious of anything that seems out of the ordinary, scrutinizing email, web pages, and even phone calls – all in the name of protecting the organization from successful attack.

—

Cyber Safety Net is a KnowBe4 partner. Reposted with permission from https://blog.knowbe4.com/it-only-takes-1-phish-wichita-state-university-employees-get-fooled-into-losing-their-paychecks. Cyber Safety Net – keeping you safe online. See https://cybersafetynet.net/cyber-security-awareness-training/ to train and strengthen your human firewall. See https://youtu.be/UFpFesrcnvY and https://www.knowbe4.com/security-awareness-training-features/ to learn more.