Cyber attacker demands fees from parents at private girls’ school

Parents of students at a Melbourne girls’ school have been targeted by hackers demanding payment for bogus invoices.

Hackers have demanded parents at a Melbourne girls’ school pay bogus invoices.

A Melbourne girls’ school has been the target of a fake invoice scam designed to trick parents out of thousands of dollars.

Strathcona Girls’ Grammar alerted parents last week that it had been hacked, urging them not to pay bogus invoices for outstanding fees.

The school’s business manager Jack Palumbo said the email with the subject line “Remittance Advice” was being investigated.

“This is a fraudulent email from a hacker and should be deleted without clicking on any attachments or links,” he said in the letter to parents.

The school asked any parent who had fallen for the scam and paid fees to make contact.

It is unclear how many parents at the school, which has campuses in Canterbury and Kew, received the emails.

On Thursday, this week, the school’s public relations company confirmed the phishing incident.

“I can confirm there was no breach of sensitive data and those who received the communication were immediately notified.”

Police said they were not aware of the incident.

Melbourne University computing and information systems expert Dr Suelette Dreyfus said while she could not comment on the Strathcona case it was “tough for schools that have to clean up from these sorts of attacks”.

She said it was demoralising for individual staff who never intended for such a thing to happen.

“For organisations facing this sort of problem in a general sense, a “no blame” culture is often helpful. Good approaches include honesty with the potential fraud victims via notification, for example, and a constructive, team-based rethink of security looking forward,” she said.

“You can’t fix what you can’t find, and, in general sense, a “no blame” cybersecurity culture helps people be more forthright about incidents and problems.”

Fees at Strathcona range from $18,000 for kinder through to $33,000 for Year 12. Fees are often levied monthly or by quarterly invoices.

In 2019, Balwyn High School had its online portal hacked. Someone using a teacher’s account posted an offensive message to the school newsfeed.

Two years earlier, personal data was stolen from Blackburn High School

The hackers also sent fake emails to parents, purporting to be from the school’s principal.

Weeks later there was unauthorised access of information at Camberwell High School.