Information Theft Under Investigation

Police at the University of Central Oklahoma are continuing to investigate the theft of payroll information and paychecks involving two UCO employees that occurred in July.

The university’s Payroll Office reported this issue to UCO Police and appropriate state agencies. UCO’s Information Technology team was also involved in the investigation and had discovered that those employees’ emails had been hacked because they clicked on a link.

“There is nothing to indicate this incident was a part of a broad data breach,” said Adrienne Nobles, UCO assistant vice president for university communications. “It was the result of individuals clicking on fraudulent links in an emailed phishing attempt.”

UCO Police are still investigating this incident. The report shows that one of the checks had the amount of over $9,000.

According to Nobles, UCO’s Payroll office received requests to change direct deposit information from two separate UCO employee emails in July. Those requests came with the appropriate form and their personal information.

“It was discovered neither employee had initiated the change request,” Nobles said. “In both cases, the checks were stopped before any funds were stolen.

“Once a person clicks on a link in an email, that likely appears to come from someone they may know, cyber criminals can gain access to personal information,” Nobles said. “There is no evidence […] that this is a widespread issue with UCO employee emails.”

Some faculty and staff have been warned to check the deposit of their paycheck and be careful with their emails.

To prevent the incident from happening again, UCO has adjusted the practices of changing employee information. A request should be hand-delivered with a photo ID. If a request is not hand-delivered, UCO Payroll office will call the employee at their campus extension and verify their personal information.

“UCO Information Technology also regularly trains and reminds employees and students about cyber security issues such as phishing,” Nobles said. “UCO employees are also required to attend annual cyber security training.”