Just as an FYI, another round of these must have just gone out last night. Shared file name is the same - 2024 PAYROLL UPDATE.docx - and the domain it's coming from is  @kckps.org (Kansas City Kansas Public Schools). I've already emailed their support.

On Mon, Mar 4, 2024 at 3:25 PM Trey Cates - Director of Technology <[log in to unmask]> wrote:

Same here. We had a user fall for it, but our business office was smart enough to report the message.

Sincerely,

Trey Cates
Director of Technology
[log in to unmask]
Central Vermont Supervisory Union
111B Brush Hill Road
Williamstown, VT 05679

(802) 433-5818 ext. 1887
(802) 433-7087 (My Direct Line)
(802) 433-7095 (Technology Team Help Desk)
(802) 433-5825 (Fax)

BOOK AN APPOINTMENT ONLINE: CLICK HERE

 

On Fri, Mar 1, 2024 at 11:07 AM Raymond Ballou <[log in to unmask]> wrote:

Dear List

We had an account compromised, the only thing to add so far is that the bad actor emailed our business office to have the employee's direct deposit changed (which we won't do based on an email of course) about an hour BEFORE they started sending out emails.

Thanks to all,

R

-----------------------------------------------------------------------

Search the SCHOOL-IT Archive

Manage your Subscription to SCHOOL-IT

This email communication and any attachments may contain confidential and privileged information for the use of the designated recipients. If you have received this communication by mistake, please destroy and contact the sender.

-----------------------------------------------------------------------

Search the SCHOOL-IT Archive

Manage your Subscription to SCHOOL-IT

-----------------------------------------------------------------------

Search the SCHOOL-IT Archive

Manage your Subscription to SCHOOL-IT