DENVER – Several Denver Public Schools employees were tricked by a phishing scam that may have led to the theft of seven direct deposit paychecks worth a total of $26,000.
Denver police spokesman Sonny Jackson confirmed to 7NEWS that the department is conducting a criminal investigation as a result of the missing funds, and said there are many outstanding questions.
“How were these accounts accessed? What was the entry into their accounts? And where did the money go from there?” said Jackson.
In an email sent to DPS employees Wednesday, Chief Operating Officer David Suppes said email accounts have been the target of a series of phishing emails over recent months. The sender is using fraudulent pretext to trick the recipients into giving up personal information.
A source provided a copy of Suppes’ email to 7NEWS.
Suppes added that on Friday, Feb. 27, the district received an initial notification from an employee who reported that their monthly paycheck was not deposited to their bank account. At that point, the district launched an internal review.
In his email, Suppes said the district had reason to believe that the personal information of seven employees were compromised by a phishing email that contained a link that asked the employees to provide their DPS username and password.
MORE | What is a phishing scam? How do you avoid them?
Shepman confirmed that seven paychecks were lost and said a total of 162 employee accounts were identified as “at-risk.” Those accounts are now disabled.
DPS sent 7NEWS the following statement:
“We do not have reason to believe any additional accounts are at risk.”
The district also warned all employees to be vigilant.
Employees were asked to confirm that their payroll information is accurate and to change their passwords as a precautionary measure.
DPS said if an email account is compromised by a spam website, it will take the following steps to prevent further emails from sending from the account:
- The user’s email password will be reset to disable the spam process.
- Department of Technology Services will contact the user to coordinate scanning the computer for a virus or malware.
- The email box will be examined for spam emails that need to be removed.
- The Outlook configuration will be examined to identify any changes caused by a virus.
Cyber security experts such as Charles Tendell, say the impact of phishing can be widespread.
“Is there still a risk present in the system?” asked 7NEWS Reporter Marc Stewart
“If they have admin passwords, if they’ve got important people’s names and passwords, there’s no telling what kind of things they can set up in the background,” said Tendell.
DPS employees who were concerned about their credit and personal information were asked to review and utilize credit monitoring resources.
Stay in Touch Anywhere, Anytime with News, Weather and Video — Download the 7NEWS app: