A targeted phishing email requesting University of Connecticut students and faculty members to validate their email addresses was sent out Tuesday, according to university officials.
The email was sent at 9:05 a.m. The URL was blocked by 9:50 a.m. and UConn spam appliance was “configured to block the message shortly thereafter,” UConn deputy spokesman Tom Breen said.
The email stated: “Dear (UCONN) E-Mail Account User, you have exceeded your (UCONN.EDU) email quota. Click on the link below to re-validated your UCONN email account.” It was signed University Information Technology Services (UITS), but the email was sent from firstname.lastname@example.org.
“It is always possible to create an email that, on casual inspection, appears to come from a legitimate source. As a best practice, people should be extremely wary of requests for personal or other sensitive information from a mechanism that they did not personally initiate,” said Haleh Ghaemolsabahi, a UITS computer technician.
The recipients of this message were a small percentage of university email addresses, Ghaemolsabahi said.
She said UConn’s system was not hacked but rather the attacker used a list of publically available email addresses.
The issue with having UConn email’s being public is the possibility of being hacked by an outsider.
“I’m not too concerned but I don’t want any more spam than what’s already in my account,” Sam Sweitzer, fourth-semester accounting major, said.
Ghaemolsabahi said students who did click on the link in their email should immediately change their passwords.
UITS also monitors for suspicious activities associated with the phishing attack, Ghaemolsabahi said.
“There are multiple layers of protection that are in place, both at the university and in other email services. However, threats and responses evolve continuously. Exposure can be reduced but will never be eliminated entirely. Individuals should always exercise caution when they are approached, even when it appears to come from a source they recognize, and asked to take specific actions or to share information,” Ghaemolsabahi said.