I just received a report from a staff member at WSESD who received an email
with the shared doc,  "NEWSLETTER !!!PAYROLL CERTIFIED DOC 2024.docx" from @
kckps.org domain.

On Thu, Mar 28, 2024 at 7:42 AM Tim White <[log in to unmask]> wrote:

> Inbound Shield™ has detected this email came from an external source. You
> are advised to be cautious when clicking on links or opening attachments.
>
> Thanks for sharing! With everything that's going on, people are sensitive
> to anything marked "payroll".
> Tim
>
> Tim White (he/him)
>
> *Systems Administrator*Addison Northwest School District
> Vergennes Union High School
> 50 Monkton Rd.
> Vergennes, Vt. 05491
> 802-471-2331
> Fax 802-877-2558
>
>
> On Thu, Mar 28, 2024 at 6:35 AM Suzanne Lee-Ciambra <
> [log in to unmask]> wrote:
>
>> We also had one come from Vermont Academy - we reached out to the
>> "sender" who said she knew her account was compromised and they were
>> working on it. Subject was "Attention Required - Urgent Notification" and
>> somehow bypassed my email quarantine for shared documents and went straight
>> to the recipient.
>>
>> On Thu, Mar 28, 2024 at 6:23 AM Tina Scheindel <
>> [log in to unmask]> wrote:
>>
>>> Thank you Nick for the heads up!
>>>
>>> On Thu, Mar 28, 2024 at 6:00 AM Nick Clark <[log in to unmask]> wrote:
>>>
>>>> Just as an FYI, another round of these must have just gone out last
>>>> night. Shared file name is the same - *2024 PAYROLL UPDATE.docx *- and
>>>> the domain it's coming from is  @kckps.org (Kansas City Kansas Public
>>>> Schools). I've already emailed their support.
>>>>
>>>> On Mon, Mar 4, 2024 at 3:25 PM Trey Cates - Director of Technology <
>>>> [log in to unmask]> wrote:
>>>>
>>>>> Same here. We had a user fall for it, but our business office was
>>>>> smart enough to report the message.
>>>>>
>>>>> Sincerely,
>>>>>
>>>>> Trey Cates
>>>>> Director of Technology
>>>>> [log in to unmask]
>>>>> Central Vermont Supervisory Union
>>>>> 111B Brush Hill Road
>>>>> Williamstown, VT 05679
>>>>>
>>>>> (802) 433-5818 ext. 1887
>>>>> (802) 433-7087 (My Direct Line)
>>>>> (802) 433-7095 (Technology Team Help Desk)
>>>>> (802) 433-5825 (Fax)
>>>>>
>>>>> BOOK AN APPOINTMENT ONLINE: CLICK HERE
>>>>> <https://calendar.app.google/GN3AGnTvSsvLW9uT8>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Fri, Mar 1, 2024 at 11:07 AM Raymond Ballou <
>>>>> [log in to unmask]> wrote:
>>>>>
>>>>>> Dear List
>>>>>>
>>>>>> We had an account compromised, the only thing to add so far is that
>>>>>> the bad actor emailed our business office to have the employee's direct
>>>>>> deposit changed (which we won't do based on an email of course) about an
>>>>>> hour BEFORE they started sending out emails.
>>>>>>
>>>>>> Thanks to all,
>>>>>>
>>>>>>
>>>>>> R
>>>>>>
>>>>>>
>>>>>> -----------------------------------------------------------------------
>>>>>>
>>>>>> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT
>>>>>> Archive
>>>>>>
>>>>>> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
>>>>>> Subscription to SCHOOL-IT
>>>>>>
>>>>>
>>>>> *This email communication and any attachments may contain confidential
>>>>> and privileged information for the use of the designated recipients. If you
>>>>> have received this communication by mistake, please destroy and contact the
>>>>> sender.*
>>>>>
>>>>> -----------------------------------------------------------------------
>>>>>
>>>>> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT
>>>>> Archive
>>>>>
>>>>> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
>>>>> Subscription to SCHOOL-IT
>>>>>
>>>> -----------------------------------------------------------------------
>>>>
>>>> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT
>>>> Archive
>>>>
>>>> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
>>>> Subscription to SCHOOL-IT
>>>>
>>>
>>>
>>> --
>>> Tina Scheindel, Technology Director and Integration Specialist
>>> Orange Southwest Supervisory District
>>> 24 Central Street
>>> Randolph, Vermont 05060
>>>
>>> www.orangesouthwest.org
>>>
>>> 802-728-5052
>>>
>>>
>>>
>>> -----------------------------------------------------------------------
>>>
>>> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT
>>> Archive
>>>
>>> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
>>> Subscription to SCHOOL-IT
>>>
>>
>>
>> --
>> Technology Department Coordinator
>> She/Her/Hers
>> Set up a meeting here <https://calendly.com/suzanneleeciambra>
>>
>> -----------------------------------------------------------------------
>>
>> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT
>> Archive
>>
>> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
>> Subscription to SCHOOL-IT
>>
> -----------------------------------------------------------------------
>
> Search <http://list.uvm.edu/archives/school-it.html> the SCHOOL-IT Archive
>
> Manage <http://list.uvm.edu/cgi-bin/wa?SUBED1=SCHOOL-IT&A=1> your
> Subscription to SCHOOL-IT
>


-- 
Sean McLoughlin

BUHS/BAMS/WRCC IT Support Specialist & AV Manager
802-451-3456
[log in to unmask]