Students attempting to access their school email accounts over the summer may have noticed something fishy going on – their accounts were totally shut down.
That is because on July 31, Camas High School (CHS) students received emails from various CHS staff members detailing an exclusive job opportunity. The emails promised an online summer employment opportunity paying $300 weekly with flexible hours. The Camas School District (CSD) confirmed these emails to be phishing attempts that were sent after various staff email accounts were compromised.
Inside, a Google Form asked students to fill out their name, age, phone number, and financial institution. On Aug. 6, students who had filled out the Google form received a text from a mysterious number claiming that they were accepted for the position. The number then asked students for their banking information to send them a $500 check through email. Students were told to use the money to purchase equipment for the job, including a mini printer, scanner, and mini filing cabinet.
The CHS community received a cautionary email from the CSD tech department on the evening of Aug. 6.
“One of our staff email accounts was compromised and used to send a phishing email to some students and staff,” Director of Operational Systems Sherman Davis wrote in the email. “We took immediate action to shut [the compromised staff account] down, secure the account, and reset or disable any compromised accounts.”
On the morning of Aug. 8, CSD students received a second phishing email from the account of a staff member at Prune Hill Elementary School. After that email went out, students lost access to their school email accounts for about a week.
Although this is the only time in recent years that students have been impacted by a phishing incident, staff members have had similar experiences more recently.
“I’m a district employee and have received numerous ‘legitimate’ emails from the district about phishing scams going on,” a CSD bus driver who chose to remain anonymous said.
The anonymous staff member went on to share an incident last year where a person claiming to be CHS principal Kelly O’Rourke asked them to buy $600 worth of gift cards. They claimed O’Rourke sent out an email to staff to notify them of the incident.
Davis sent out an email to staff on Aug. 8 following the incidents. The email encouraged staff members to exercise caution to avoid falling victim to phishing attempts. Among other suggestions, Davis encouraged staff to avoid links from senders outside of the district and be wary of urgent requests and poor grammar.
“Your vigilance is our best defense against these threats,” Davis wrote in the email.
Davis responded to the Camasonian’s request for information regarding the incident, confirming that the CSD tech department had disabled students’ emails.
“The district acted quickly to contain a phishing incident involving a compromised staff account,” Davis wrote in the email. “The affected account has been secured, malicious messages have been removed, and security measures have been reinforced to help prevent future incidents.”
As of Aug. 19, CSD had not yet removed the second phishing email from student accounts and has not communicated the second wave of phishing emails or the subsequent email shutdown to families over ParentSquare.
