On Tuesday, Jan. 16, some members of the school fell victim to a phishing attack. Phishing refers to the fraudulent practice of sending emails through reputable sources to induce individuals to reveal personal information.
Outside parties attempted to compromise a St. Paul’s employee for data gathering. The source sent an email through an SPS employee account titled “Job Opportunity,” enticing many students to fill out a survey that asked for personal information including emails and home addresses.
Even though St. Paul’s has never offered “job opportunities” to their students, due to the reputability of the school email account, many students fell for the trap: “I was excited, but confused. it seemed like a good job opportunity, was a good salary, and seemed like it would help me get experience in the workforce,” says Tori Martinez ‘26.
Brooks Fisher ‘25 admits he fell for the email as well. “Yes, I clicked on the link and filled out the form twice,” he says. “I was just so eager.”
Many students filled out the form and waited anxiously to see if they had gotten this so-called “job opportunity.” It is impossible to know how many students filled out the form.
Recognizing the suspicious activity, members of the Information Technology Department “immediately locked out the suspect account, changed passwords, and started dropping any connection attempts to that account,” says Director of Information Technology Scott Morin.
As of Friday morning, Jan. 19, Morin says all attempts from the outside account to infiltrate St. Paul’s systems have stopped.
“Even though students may not realize it, at any moment in time, hackers and outside users are trying to break into our school’s system,” says Morin.
SPS, like many other institutions, uses firewalls and other security measures to protect the school from unauthorized organizations.
“We can put the best systems in place, the most secure firewalls and email filters, but it’s always the human component where we struggle, and it breaks down,” says Morin.
He urges students to remain vigilant with where and to whom they hand out their personal information to avoid a repeat of Tuesday’s incident, or anything with harsher consequences.