All students and faculty at Creighton have won the European lottery and are about to receive $1 million right after they send in their $100 transportation fee. That or there was a huge phishing scam at Creighton.

Over the weekend, two faculty and staff members had their account e-mails and passwords stolen by a phishing scam.

“Phishing is an e-mail that is sent to look like an authentic request, but it comes from an illegitimate source that is typically trying to scam personal information out of you,” Bryan McLaughlin, information security officer said. “They say, give us your e-mail/password, and they turn around and send a significant amount of spam.”

Creighton has been a victim of phishing for a long time, but it has only recently become a victim of the trend of “spear-phishing,” which is when the scammer sends out e-mails specifically targeted to one audience, in this case, Creighton University.

“Whoever is doing it must be checking our Web site to make this thing,” McLaughlin said.

“The previous letter said Creighton at least three times. A lot of these messages look authentic, so I can understand why people fall for them. I think what you should do is just look at the return address. These ones have been coming from Korea.”

This last weekend, the phishers sent out 500,000 fake e-mails which promised millions of euros after he or she sends $100 to the address, according to McLaughlin. Phishing takes time for the staff of DoIT to clean up the mess.

“It probably takes, on average, 12 staff hours to resolve or clean it up,” he said. “In addition to that, mail slows way down. Monday it may have taken several hours for mail; outside the university it may have taken four hours. It just gets choked up, not so much by outgoing messages but by incoming messages from the spammers.”

The influx of spam coming from Creighton e-mails also causes companies like Yahoo! and Google to block them from e-mailing their accounts. According to McLaughlin, this inconveniences everybody from students trying to e-mail friends or admissions trying to contact prospective students.

“Overall, there is really only one thing you need to know to avoid this,” McLaughlin said. “Creighton will never, under any circumstances, ask for your password.”