A hacker sent more than 10,000 spam emails to AACC email accounts in March, the college reported. 

The emails went to a random mixture of students, faculty, and staff and contained a link to a fraudulent website designed to look like the AACC login page.

Director of Information Security John Williams noted that he discovered the breach when he received the email himself. Plus, he said he “had many, many people send him the email [to] say it [was] bad.” 

Hackers “are targeting the college, but they are not targeting anybody specifically,” Williams said. “When we talk to other community colleges here in Maryland, we are all fighting the same battle of people trying to capture .edu accounts.”

The spam email told users that the college had locked their email accounts and that to regain access, they needed to click on a link in the spam email to verify their accounts. Students who clicked on the link saw what looked like AACC’s homepage.

Students who logged into this fraudulent page unwittingly gave the hacker access to their AACC portal usernames and passwords.

The college responded by changing the photo on the AACC portal webpage so it would no longer look like the page that the hackers copied.

“The faster [the college] can take action, the less impact it is to everybody,” Williams said.

Williams said it is usual to see one to three compromised accounts a day belonging to a student or staff member but a mass threat like this one is not as common. 

Still, it is important for students and staff to protect themselves from breaches by “[making] strong passwords and not [reusing] the passwords,” he said.

Using different passwords for different accounts will minimize the risk that a hacker will steal them, he added.

Email accounts with .edu extensions are valuable to hackers who can use them for discounts and free services from companies like Amazon and newspapers that lower the price for students.