Dear University of Waterloo community,
Over the last week, Information Systems & Technology (IST) has observed an increase in phishing attacks to uwaterloo.ca email accounts. A recent example has the subject line “Office of the Vice-Principal & Dean: Student Application Form”. Recipients are asked to provide various forms of personal information, including but not limited to password, Duo code, date of birth, and social insurance number. Attackers will solicit this information through various means, including:
- A PDF attachment containing a link, or an email address;
- A Google form with a University of Waterloo (UWaterloo) logo at the top;
- Text message; and/or
- Email (including your personal email account).
Attackers often use compromised accounts from UWaterloo, and other institutions, to legitimize their attacks. They will also attempt to draw you away from UWaterloo services, making it more difficult for IST to detect and disrupt these attacks.
If you are tricked into clicking on such a link that takes you to a fraudulent web form, do not panic. Do not enter any information. Scroll down to the bottom of the form and click on “Report abuse” (or similar language), select “Phishing” to submit the report, then close the browser window. Again, do not submit any information about yourself. If there is no such link, simply close the browser window.
Please report suspected fraud attempts to the IST Security Operations Centre at soc@uwaterloo.ca. Reports of successful fraud should be directed to the UWaterloo Special Constable Service at uwscs@uwaterloo.ca.
Read more about cyber security best practices: https://uwaterloo.ca/cyber-awareness/
IST will continue to review our security measures and adjust appropriately in response to threats as they grow in sophistication. Thank you for your continued vigilance, support, and contribution in keeping the UWaterloo community cyber safe.
If you have any questions or concerns, please contact the IST Service Desk at helpdesk@uwaterloo.ca or call ext. 44357.
Read more about cyber security awareness.
Jason Testart
Director, Information Security Services
Information Systems & Technology