Four staff members’ emails were shut down this past week in response to a phishing scam where recipients received an email from a known contact that asked them to view photos in Dropbox.  Phishing usually occurs when the scammer uses contact information located in an email account; they send out widespread “phisher” emails to get people to “bite” and attempt to respond.

Phishing has become a standard tool for identity theft; however, these “phishers” have become more adept at making emails appear legitimate, as evidenced by the people who fell for them this time.  The phisher was able to gain information from a few people who responded, but quick action on the part of IT and administration prevented the scam from widespread sharing and infiltration.

“[Phishing] is pretty common,” director of technology Greg Royar said. “It has been a severe inconvenience, but other than that, it hasn’t really affected the school that much.”

After a staff member’s account was compromised, an email was sent out under the premise that the user was trying to share photos through Dropbox. If the recipient entered their email information, the scammer logged their credentials, and the cycle continued.

“I knew we were getting the spam, but I didn’t know it was going around the whole district,” principal James Hill said. “You naturally think that when you see an email from someone you know, you should open it up.”

Information was only taken if recipients clicked the link embedded in the email and entered in their username and password.

“A lot of people refer to it as hacking, but it’s not anything that has actually been hacked,” Royar said. “It’s because the users provide their information.”

Unlike the majority of phishing emails many staff members receive, this incident presented itself less obviously.

“I trade pictures with people for different things, like the sports program and football program, and I get pictures from The Talon, occasionally, that we use for different things,” athletics administrative assistant Susie Vickery said. “It’s not uncommon for me to use dropbox.”

Even with the deceiving appearance, the scam only affected a few individuals.

“I thought it was interesting that we have around 250 staff and probably about 1500 kids with accounts, and none of the kids fell for the scams from what I’ve seen so far,” Royar said.

While the school has firewalls in place to filter most of these scams, Royar shared precautionary advice.

“Don’t enter your credentials into any page that has redirected you,” Royar said. “The only place you want to put your credentials is somewhere that you actually typed the address into the address bar.”