Virginia Tech University’s Webmail Hit by Phishing E-mail

A phishing e-mail imitating the University hit the webmail system of Virginia Tech. The e-mail was reported by University's webmail users on January 31 and February 1, 2009, and since then, it has affected around 200 students of the University, as reported by COLLEGEATETIMES on February 3, 2009.

Preliminary investigations have revealed that students and faculty members who received the phishing e-mails were asked to provide their PID (Personal Identification) numbers and passwords to maintain the webmail.

William Dougherty, Director of System Support, Virginia Tech, blamed the poor and inefficient spam filters for recent increase in phishing e-mails at Tech webmail. Dougherty further stated that generally, a spam mail through the University's webmail hits around 10% of 130,000 legal Tech e-mails. Moreover, the proportion of users who receive such e-mails and responded with the requested information is between 2% and 5%, as reported by COLLEGEATESTIMES on February 3, 2009.

According to IT officials at the University, e-mails containing Trojan viruses also infect the users' PCs beside phishing e-mails.

Reacting to the rising number of complaints about the phishing e-mail from University webmail users in the last week of January 2009, Virginia Tech issued an official warning in the campus to caution the students. The warning states that a new phishing scam has been hitting the community members. It purports to be from legitimate support group and requests for personal identifying information, but in the latest case, it sought for members' password.

The official warning also informed members that IT support organization at Virginia Tech do not ask for such information, especially passwords, on e-mail.

Thus, the IT support organization has recommended all webmail users who have replied to the phishing e-mail with requested information (password) to change their existing passwords immediately. They can use the portal https://my.vt.edu for changing password.

Similarly, Division of Information Technology (DoIT) at Madison has warned the University of Wisconsin (UW) students about an e-mail scam involving WiscMail that provides webmail services to the student as well as staff.

Related article: Virginia - Top Spammer Challenges the anti-spam Law

» SPAMfighter News - 2/17/2009