[Mail_treas] IMPORTANT: Email Phishing Attempts Impersonating Ohio DEW

[Thor Sage]

Good afternoon.
Please see the important information below pertaining to a malicious phishing campaign targeting Ohio educators.  Please warn your staff of this activity so that they don’t inadvertently provide personal information or OHID credentials to attackers.
Thank you,
Thor

Thor Sage
Executive Director
Miami Valley Educational Computer Association
937-767-1468  x3101
[http://www.mveca.org/images/logo.gif]<http://www.mveca.org/>       [i] <https://www.linkedin.com/company/mveca/>
Not-for-profit Technology Services for Education and Local Governments




Subject: Email Phishing Attempts Impersonating Ohio DEW

Superintendents, Treasurers, and Technology Coordinators,
We want to make you aware of a phishing campaign currently targeting Ohio educators. The attackers are using real data pulled from the Ohio Department of Education and Workforce (DEW) public database to make their emails appear legitimate.
These emails claim that an educator’s teaching license is at risk of suspension unless they “verify their information” within 24 hours. A sample of the message appears below. It includes authentic district and personnel details (IRN, address, phone, names, and emails) to create a false sense of credibility.
The message directs recipients to a fraudulent verification page that mimics the OHID login portal. However, the fake site displays “IDOE” instead of “OHID” — a clear indicator of its illegitimacy.
________________________________
Example Subject Line:
Ohio Department of Education and Workforce – 2025 School Information Verification
Example Message Snippet:
From: Ohio Department of Education <contact.center at education.ohio.gov<mailto:contact.center at education.ohio.gov>>
Date: Tue, Oct 14, 2025 at 12:08 PM

“Failure to verify this information within the next 24 hours will result in suspension of your license.
Click the secure verification link below to complete the process.”

I hope this message finds you well.

We are reaching out to kindly request your prompt attention to verify the information we have on file for you.

We must ensure the accuracy and completeness of these records in accordance with Ohio Revised Code, specifically Chapter 3314.

Please take a moment to review the information provided below:

Important: Failure to verify this information within the next 24 hours will result in suspension of your license.

Click the secure verification link below to complete the process. This link will expire in 24 hours.

Your prompt attention to this matter is crucial. We urge you to act promptly.
The email then lists accurate school data from the DEW website before linking to the fake login page shown below.

[cid:image002.png at 01DC3D0C.5D994560]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listserv.mveca.org/pipermail/mail_treas/attachments/20251014/f4e3a693/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 283977 bytes
Desc: image002.png
URL: <http://listserv.mveca.org/pipermail/mail_treas/attachments/20251014/f4e3a693/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 3184 bytes
Desc: image003.jpg
URL: <http://listserv.mveca.org/pipermail/mail_treas/attachments/20251014/f4e3a693/attachment-0002.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.jpg
Type: image/jpeg
Size: 1229 bytes
Desc: image004.jpg
URL: <http://listserv.mveca.org/pipermail/mail_treas/attachments/20251014/f4e3a693/attachment-0003.jpg>