To Faculty, Staff, and Students:
As part of ongoing efforts to maintain regulatory compliance we have updated our password policy and we need everyone to check their password immediately to ensure that it meets our Minimum Security Requirements.
Please click here to do that:
Check Password
Please do this right away.
Thanks!
This is just one of the emails students at Ashland University received from I.T. on Wednesday, March 29th. This email that at first appeared to be normal soon spread panic when people became suspicious and word quickly spread that it was a scam. I myself have fallen victim to this scam, clicking on the link and giving up my email and password only to get this text from my managing editor an hour later:
Word was spread fast on Twitter, Facebook, text, email, and face to face. Pretty soon almost every AU student knew, and for those who didn't know ahead of time took action.
And it wasn't until three hours later that something popped up with on my email that wasn't there previously:
We thought the scare was over. We thought everything was going to go back to normal... but we couldn't help but think of a few things. If it really was IT, why wasn't a signature at the bottom of the email with the AU seal like in most emails we may get from RAs or professors? And if it wasn't, how did they send the scam through IT's email? What's the point of this scam, because just with our personal information they can't get much of our information or any money out of it? There were many questions throwing red flags all over the play, but it was over. Wednesday had passed, everyone was warned, and we wouldn't have to worry about this again... or would we. Thursday after we had received yet another email, this time from the president of the university. On my phone, the ending of the subject was cut out so it appeared as Message from the President: Phishin.... My friends and I thought it was an apology for what happened on Wednesday and that the matter is being taken care of as we speak. No, instead we find out it was just a test that President Campo has devised, while IT told other students the day before they didn't send out an email. If it's not bad enough to make students think this is a scam, he also tracked the emails giving us stats:
Of those that received the email: 4278 people (32%) opened the email (8% above Higher Education average); 1804 (13% about 4% above norm) clicked on the link which took them to Ashland Webpage (spoofed with AU Athletic Logo); 5 individuals replied to the email; 50 people called AU TSC and changed their passwords; and 1361 (10% approximately 4% above expectations) entered their user credentials (password and username).
I understand that security tests are helpful, but not when it causes a pandemic and freight all around campus. Many are furious with President Campo's decision on this matter. Angela Cantor, a mother and commuter of Ashland University, stated: "I think it's a valid idea to check the security of your network. It's also good to educate students to be wary of emails from scammers, but the anxiety this particular idea caused was a bit unnecessary. There are other less scary ways to do that. The security of our personal information is not a joke." Others would agree to statement as many of them are furious, including AU student Maria Cardona who had many good points on the matter. "I appreciated the university's attempts at making us think about our safety and trying to prep us, but I think:
a) as part of the test they should've sent out an official message to everyone not to answer it without telling us it was a test
b) it shouldn't have taken them over 24 hours to tell us what was going on after sending campus and IT into a frenzy and
c) they should've told us it was a scam on platforms other than Twitter because not everyone uses Twitter and people were only finding out through social media when the university should've had a better action plan.
Others commented that it was just "Fake news" or that this is the second time this month they had to change their password and find this whole thing to be stupid in the first place. Many students are enraged, and teachers even got the email unaware of Campo's plan which led them to believe it too was a scam. As for IT, were they involved, or did they truly not know about the email? How much farther is Campo going to take his testing before students have it with him? Will Campo pull another stunt like this in the future? These are the questions we must ask ourselves, and for President Campo's sake he better hope he doesn't cause another panic attack among the student body or he's going to have a lot of angry students on his case.
