UIC’s response to rising cyberattacks
Dear UIC students, faculty and staff,
The UIC Information Security Team works hard to detect, mitigate and deter cyberattacks, also known as “phishing attacks,” affecting the UIC community. In recent years, there has been a global increase in cybercrime across every industry, and UIC is no exception.
While these attacks target members of the UIC community every day, our security team and other members of the IT community detected a notable increase in malicious activity Thursday, Jan. 19. These recent phishing attacks (offering free musical instruments, warning of imminent account closure, etc.) were mostly sent from valid UIC email accounts that had been compromised.
To reduce the impact of compromised accounts and subsequent phishing attacks, we are significantly reducing the number of emails an account can send in a 24-hour period. This reduction will limit the damage that can be inflicted by a compromised account.
Based on data from the email system, this new limit will impact a very small number of accounts that are legitimately sending large volumes of email. Those accounts will be exempted from the limit temporarily, and our team will work with each account holder to ensure their email distribution needs are met. This limit will not impact university-sponsored messaging systems such as Webtools, Listserv, Blackboard and various ticketing systems.
On a related note, we are asking all members of the UIC community to be diligent when reviewing Duo Two-Factor Authentication prompts. Our data shows that nearly all of the compromised accounts were granted access to the email system by users who accepted 2FA prompts they did not initiate. This practice eliminates the effectiveness of 2FA and provides an open door to malicious actors.
If you receive an unsolicited Duo 2FA prompt, your account is very likely compromised, and you should deny that request and immediately change your university password. Oftentimes, cybercriminals will initiate repetitive Duo 2FA push and phone call requests until they have successfully tricked you. Be vigilant!
While there is no solution that can eliminate phishing attempts, the above actions help limit the negative impact on our community and raise awareness among the community. Below are resources to reference:
For assistance with email systems, please submit a request. For questions or comments about the above change to daily limits or our response to phishing, please feel free to reach out to me directly.
Regards,
Jason Maslanka
Chief Technology Officer
Interim Chief Information Security Officer
For more information, please contact:
Jason Maslanka
jasonm@uic.edu
Categories