June 8, 2016


Dear UM Community,

As recently reported, the University has been the victim of a sophisticated phishing attack. UM employees inadvertently provided CaneID usernames and passwords in response to emails and sign-on screens that were designed to trick the user into sharing this information. Hackers used these credentials to access and change data including direct deposit information.

We continue to encourage UM employees to enroll in Multi-Factor Authentication (MFA) as an effective way to protect personal information. Using a second factor (e.g., mobile phone or landline) in addition to your CaneID credentials is far more secure than your username and password alone. Since hackers don't have physical access to these devices while attempting to compromise your account, your information is secure. To enroll in MFA, visit: https://caneid.miami.edu/.

What is phishing? Phishing is a form of fraud, in which an attacker tries to learn private information (such as login credentials) by masquerading as a reputable entity or person (usually via email). The following is an actual phishing email that was sent within our UM community:

If you recognized this email as spam/phishing and immediately deleted it, thank you for being vigilant. If you opened the message and clicked on the link, please be aware that attackers often include links in emails to lure you to fraudulent websites where they can collect your login credentials and/or malicious software can be downloaded to your device(s).

To investigate where a link will take you, hover over the link with your mouse pointer (as seen in the screen shot below). If the URL appears to be from outside the University or does not match the link, then it is most likely a phishing email.

Criminals have access to tools that replicate legitimate company sites. In this case, the UM Single Sign-On webpage was replicated. A key indication of whether a site is real or not is the URL. Take a look at the phishing attack URL in the address bar below (the real UM Single Sign-On page will display as https://caneid.miami.edu/ or https://caneidhelp.miami.edu/caneid/):

Phishing is an ongoing challenge for the University of Miami and many other institutions and businesses around the world. For this reason, UMIT Security is offering supplemental training in ULearn. To access the training, visit http://ulearn.miami.edu and enter Phishing - Don’t Get Hooked into the search bar, located on the top right-hand corner of the page. Select the course and register.

If you suspect you may be a victim of phishing, or would like help setting up Multi-Factor Authentication, please contact the UMIT Service Desk at: (305) 284-6565 or itsupportcenter@miami.edu.

Thank you,

Thomas J. LeBlanc
Executive Vice President and Provost
Joe Natoli
Senior Vice President for Business and Finance and Chief Financial Officer