Phishing 101 at the School of Hard Knocks
Summary: Bowling Green State University accelerated its mandatory two-factor authentication rollout after seeing nearly twice as many phishing victims in the first two-and-a-half months of 2017 as in all of 2015, with compromised accounts rising from 250 in 2015 to 1,000 in 2016 and roughly 400 in the first 75 days of 2017. On March 1, 2017 all BGSU account holders were required to change passwords, and on March 15 Duo 2FA was placed in front of the MyBGSU portal after phishers siphoned student bank accounts and W-2 tax forms.
What's compelling: Left unchecked, phishers were on track to steal credentials from nearly 10 percent of BGSU's more than 20,000 students and faculty by year's end - and the thieves deleted the university's change-notification emails from victim inboxes and trash folders to cover the fraud.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026