<div dir="ltr"><p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">Hello
All,</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">I just wanted to give
you a heads up on an attempted fraud at our district so you can warn your staff
what to look for.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">Our district was
infected by the malware trickbot which steals usernames, passwords, etc.
Four of the five staff in the Treasurer's office here were attacked using this
malware. There were several incidents but the most severe was an actual breach
of our online banking. They had changed the beneficiary ABA and account
number for two of our wire templates that we used often and where large amounts
were wired. Luckily, (and I must stress that there was definitely some
luck involved which makes it even scarier), we noticed the change and were able
to correct the templates and let our bank know what had been
attempted. </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">Luckily, the changes
the thieves made were enough to make the Treasurer come to me to question why
the account looked somewhat different when he was getting ready to wire $2
million dollars. That started us looking more closely. We
discovered that on Wednesday April 17, one of our staff had modified 2
templates which was a red flag to us. Since we have a 2 person approval
requirement for all changes, they could not complete the change. We knew
that staff member would not change the template and remembered that on that
day, she was actually unable to get into the bank after her first posting to
the online banking system. We had mistakenly
attributed that to just one more difficulty we were experiencing district wide
because of the malware.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">So, what the bank
thinks happened is that when she was in the first time that day, they grabbed
all of the info she entered including the temporary random access number from
the her bank fob. Acting quickly, because the fob number is so brief,
they entered the online banking system as her and made the changes. </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">They continued on to
attack both another staff member and myself - obviously looking to snag another
set of credentials that would let them complete the change. Luckily, we
needed to do a wire transfer before they were able to do that and were alerted
to the attack. Had they succeeded in getting the other set of
credentials, we may not have realized what had happened and may have proceeded
with the wire transfer. </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">My advice to you is -
be on hyper alert if your district gets infected with a password stealing
malware like trickbot. Don't just assume that any issues or strange
incidents on staff computers can be chalked up to the malware issue in your
district. Those issues and incidents may very well mean your banking
information (or other equally valuable data) is under attack.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">Some things that
happened here (each person seemed to have a slightly different experience):</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="gmail-MsoListParagraphCxSpFirst" style="margin:0in 0in 0.0001pt 0.5in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">1.<span style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt;font-family:Arial,sans-serif">Not being able to
access the online banking system – just won’t load.</span></p>
<p class="gmail-MsoListParagraphCxSpMiddle" style="margin:0in 0in 0.0001pt 0.5in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="gmail-MsoListParagraphCxSpMiddle" style="margin:0in 0in 0.0001pt 0.5in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">2.<span style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt;font-family:Arial,sans-serif">Sudden shut down of
google chrome immediately after entering or approving a payment via the online
banking system. When you attempt to sign
back in, you get a message that chrome shut down oddly and asking if you want
to restore. When you say yes, the online
banking opens exactly where you left off.
I learned this was a BIG no-no.
If all were well, you would be forced to sign back in after an internet
shut down.</span></p>
<p class="gmail-MsoListParagraphCxSpMiddle" style="margin:0in 0in 0.0001pt 0.5in;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;line-height:107%;font-family:Arial,sans-serif"> </span></p>
<p class="gmail-MsoListParagraphCxSpMiddle" style="margin:0in 0in 0.0001pt 0.5in;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">3.<span style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span style="font-size:12pt;font-family:Arial,sans-serif">When in bank, screen
goes blank momentarily then comes back at first greyed out and then in full
color.</span></p>
<p class="gmail-MsoListParagraphCxSpLast" style="margin:0in 0in 8pt 0.5in;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;line-height:107%;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">We also learned that
at least one other district has had a similar attack. </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">This is our second
fraud attempt in the last 2 months. The
first one was an email from a vendor that we make very large regular payments
to asking to be paid by ACH rather than paper check. As we were in the process of implementing ACH
vendor payments, we were happy to oblige and requested the banking information
to make it happen. There was something
just a little fishy about the urgency they were conveying that this happen very
soon, so the Treasurer called the person who said that they had not sent the
emails. So we dodged a bullet
there. And, implemented a policy that no
ACH or Direct Deposit changes could be made without our staff calling the
vendor or employee personally and verifying that the request indeed came from
them. I would recommend this process to
everyone.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:12pt;font-family:Arial,sans-serif">I guess bottom line is
be very vigilant. The threat is real.</span></p><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">
<div>
<div name="divtagdefaultwrapper" style="margin:0px;font-family:Calibri,Arial,Helvetica,sans-serif">
<p> </p>
<p>Thank you and have a great day!</p>
<p> </p>
<p>Jacqueline Pursley</p>
<p>Assistant Treasurer - Revere Local Schools</p>
<p>Phone: 330-556-3111</p>
<p> </p>
</div>
</div>
</div></div>
<br>
<span style="color:rgb(33,33,33);font-family:Tahoma;background-color:rgb(255,255,255)"><font size="1">CONFIDENTIALITY NOTICE: This email is intended only for the addressee(s) and may contain material that is confidential under state and federal law. If you were not an intended recipient, please notify the sender and delete all copies. School District email is to be used only for school purposes. The District may monitor email to and from its network. This email and any response to it may be archived for later retrieval and may constitute a public record and therefore may be made available upon request in accordance with Ohio Public Records law (ORC 149.43).</font></span>