234 UMBC accounts suffered from this breach; DOIT is currently notifying these individuals via their UMBC emails and/or alternate emails. However, if you have a Wattpad account don't wait; contact the site to see if your information has been exposed.

If you don’t have a alternate email address listed on your UMBC account, follow these instructions below:

1. Login to your myUMBC account: http://my.umbc.edu/account

2. Go to https://webadmin.umbc.edu/admin//Security/Setup/View

3. Click Account security setup

4. At the top of the page, enter your alternate email address

5. Scroll down to the bottom of the page and click Update my security settings

DOIT has been notified of this breach via Have I Been Pwned(HIBP).

More about Wattpad data breach visit: 

https://www.bleepingcomputer.com/news/security/wattpad-data-breach-exposes-account-info-for-millions-of-users/

https://bestofprivacy.com/data-breaches/wattpad-data-breach-exposes-account-info-for-millions-of-users/#:~:text=Wattpad%20data%20breach%20exposes%20account%20info%20for%20millions,user-generated%20stories%20on%20a%20variety%20of%20different%20topics.

If you have any questions or concerns email us: security@umbc.edu_________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity

In the article linked below, BBC News warns of different Covid-19 themed frauds and scams. Many malicious actors follow the headlines just like the rest of us, and when they see a crisis like Covid-19, they take the opportunity to jump on the fear and try to scam as many people as they can. 

The article warns of these scams to be wary of:

• Covid-19 Financial Support Scams

• Fake government emails, which look to be from a government department and offer financial grants. The emails contain a link which can steal both personal and financial information.

• Scam emails offering access to a “Covid-19 relief fund”, and encouraging users to fill in a form and hand over personal information.

• Official-looking emails offering “tax reductions.” The email is reported to contain a link that takes users to a fake government website which can harvest users personal and financial information.

• E-mails offering to help Benefit recipients in applying for universal credit, but which fraudsters will grab some of the payment as an advance for their "services".

• Email about claiming fake school meal funds and fake government grants.
  
  

• Health Related Scams

• Phishing emails claiming that the user has been in contact with someone who has been diagnosed with Covid-19. The links lead to fake websites that are used to steal personal and financial information or even infect the device with malware.
  For official information on contact tracing efforts in Maryland please visit https://coronavirus.maryland.gov/pages/contact-tracing.

• Fake ads for non-existent Covid-19 related products, such as hand sanitizer and face masks. They simply will take the users’ money and send them nothing.

• Offers of fake Covid-19 test kits and hand sanitizer, or even products claiming to treat or prevent Covid-19.
  
  

• Social Distancing Related Scams

• Fake emails and texts claiming to be from “TV Licensing”, telling people they are eligible for six months of free TV because of Covid-19. Users are then told there has been a problem with their card and are asked to click on a link that takes them to a fake website designed to steal users persona and financial information.

• Emails asking people to update their TV subscription services payment details by clicking on a link which is designed to steal credit card information.

• Fake profiles on social media sites designed to try and manipulate users into giving them their money. 

• Fake investment advertisements on social media sites encouraging users to “take advantage of the financial downturn.” Bitcoin platforms are using emails and adverts on social media platforms to encourage users to put money into fake companies using fake websites.

• Malicious actors cold-calling home residents offering to do shopping errands.

• Messages telling the user that they have been fined for leaving their home more than once a day. Links in these messages are designed to steal a victim’s personal and financial information or to install malicious software onto the user’s device.
  
  

• What We See at UMBC

• At UMBC, DoIT is getting reports of work-from-home phishing emails. These phishing emails follow a similar pattern of offering a work-from-home opportunity and ask for personal information like personal email and home address. They will then send a fraudulent check to the user which should not be cashed. 

• Recently DoIT has also seen phishing emails attempting to impersonate UMBC staff and asking for gift cards or phone numbers.

For more information on these and other phishing attempts at UMBC please visit the DoIT Security page which can be found here https://itsecurity.umbc.edu/.

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

For more information, please visit: 

https://www.bbc.com/news/business-53573408

To read more articles published by DoIT Security please visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

Recently DoIT has been notified of a phishing email scam where the malicious actor is impersonating a UMBC staff member. The name has been removed from the From for privacy reasons, but an example of the email can be seen below:

The phishing email above not only is impersonating a UMBC staff member, but the email has many grammatical mistakes, and there is a feeling of urgency with the subject line “Urgent” and words like “ASAP” being used. These are just some of the examples of the red flags for identifying this and other phishing email scams.

The main goal of this phishing email scam is to get the users to purchase the gift cards and give the gift codes to the malicious actors. Other scams similar to this one might ask for products like iTunes cards, gift cards, prepaid debit cards, or even bitcoin.

If you do receive this or a similar email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

For more information on a similar scam to the one above:
https://itsecurity.umbc.edu/critical/?id=94550

DoIT has been made aware of a problem with the dial-in feature in Webex Meetings. The symptom is that when joining a meeting through the phone that users will receive an error of “You have dialed a call in number that is not supported for this meeting”.


Our vendor, Cisco, is working on the problem now. As a work around, you may use the join audio by computer function which appears to be unaffected by the problem.

Updates will be posted as the problem is resolved. 

Ray Soellner

DoIT - UMBC

rays1@umbc.edu

410-455-3256

In June 2020,  Dave, a digital banking app, suffered a data breach. 7.5 million rows of data were leaked to the public on a hacking forum. The breach exposed individuals’ Personal Identifiable Information (PII) such as names, dates of birth, encrypted social security numbers and passwords.

UMBC’s Division of Information Technology (DoIT) has been notified that over 20 UMBC accounts might have been affected by this breach. 

The individuals who have been affected by the data breach were notified via their UMBC email and/or their alternate emails. If you do not have an alternate email listed on your UMBC account, we suggest that you create one, preferably different from your UMBC email account. 

To link an alternate email account to your UMBC account follow the instructions below:

1. Login to your myUMBC account: http://my.umbc.edu/account

2. Go to https://webadmin.umbc.edu/admin//Security/Setup/View

3. Click Account security setup

4. At the top of the page, enter your alternate email address

5. Scroll down to the bottom of the page and click Update my security settings

If you have a Dave account we suggest that you contact them to see if your information has been leaked. 

The data about Dave was provided to the breach notification service Have I Been Pwned (HIBP) by dehashed.com.

For more information on Dave data breach visit:

https://www.zdnet.com/article/tech-unicorn-dave-admits-to-security-breach-impacting-7-5-million-users/

https://www.tomsguide.com/news/dave-data-breach 

If you have any questions or concerns email us: security@umbc.edu 

_________________________________________________________________________

Receive any suspicious emails?