MacEwan University in Edmonton, Alberta, has found itself in an unfortunate situation after they accidentally transferred $11 million CAD (around $9 million USD) to a scammer who deployed a phishing attack.
More than $11.4 million CAD was accidentally transferred to the perpetrator of a phishing attack, who convinced administrators and IT staff at MacEwan University that they needed to change their electronic banking information for one of the institution’s main vendors.
“A large portion of the funds have been traced—$6,347,000—to a TD bank account in Montreal and were seized by a bailiff,” university spokesperson David Beharry said over the phone in an interview with VICE. “Investigations revealed that the balance of the funds were wire transferred to two accounts in Hong Kong. The university has initiated civil and criminal proceedings. We have hired legal counsel in Montreal and Hong Kong, and they are working on recovering the $11 million.”
A statement released by the university on Thursday revealed that they had accidentally transferred the funds to the scammer. According to the statement, the funds have been frozen and the university is working with legal counsel in Montreal, London, and Hong Kong in hopes that they might be able to recover some of the money that was sent.
While the eventual financial impact will not be known until an investigation into the incident is complete, more than $11.4 million of the funds has been traced to accounts in Canada and Hong Kong. These funds have been frozen and the university is working with legal counsel in Montreal, London and Hong Kong to pursue civil action to recover the money. The status of the balance of the funds is unknown at this time.
“There is never a good time for something like this to happen,” said university spokesman David Beharry, “but as our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident. Personal and financial information, and all transactions made with the university are secure. We also want to emphasize that we are working to ensure that this incident will not impact our academic or business operations in any way.”
MacEwan University says the theft of the funds will not affect this years programs or initiatives. More details from the investigation into the phishing attack will become available in the coming weeks.