University says it was bilked out of $11.8 million

Edmonton’s MacEwan University says staff were tricked into transferring $11.8 million into a bank account believed to belong to a vendor in what one cybersecurity expert said was among the largest ever publicly disclosed phishing scams.

“There is never a good time for something like this to happen,” university spokesman David Beharry said in a written statement.

“But as our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident. Personal and financial information, and all transactions made with the university are secure. We also want to emphasize that we are working to ensure that this incident will not impact our academic or business operations in any way.”

After discovering the fraud Aug. 23, the university began pursuing criminal and civil actions to trace and recover the money.

“The Edmonton Police Service, law-enforcement agencies in Montreal and Hong Kong, and corporate security units of banks involved with the e-transfers are working to resolve the criminal aspect of the case,” a news release said.

According to the release, $11.4 million of the funds have been traced to accounts in Canada and Hong Kong. The funds have been frozen and the university is working with lawyers in Montreal, London and Hong Kong on civil action to recover the money. The status of the remaining funds is not known.

David Shipley, CEO of Beauceron Security and former cybersecurity lead at the University of New Brunswick, said MacEwan was likely the victim of a what’s called a business email compromise scam.

“It’s the single largest publicly disclosed amount I’ve seen,” he said. “That’s not to say there aren’t private companies that aren’t required to disclose this stuff that haven’t had losses, but even among the losses that are known globally, this is among the larger ones.”

MacEwan conducted an audit of its processes after discovering the fraud, implementing controls to prevent further incidents.

“Preliminary assessment has determined that controls around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed,” the release said.

In a statement, Alberta Advanced Education Minister Marlin Schmidt said he was “disappointed” the university fell victim to the crime.

“This is unacceptable and I’ve asked the board chair to report back to me by Sept. 15 with details on how this occurred,” he said. “While I’m told that MacEwan has put improved internal financial controls to help prevent it from happening again, I expect post-secondary institutions to do better to protect public dollars against fraud.”