Real-World Phishing Incident: Canadian University Falls Victim to Credential Harvesting

In early 2025, a renowned Canadian university fell victim to a targeted phishing attack that compromised hundreds of student and faculty accounts. The breach led to unauthorized access to internal systems, email servers, and student data—causing widespread disruption and reputational damage.

The scary part?
All it took was one convincingly spoofed email from a “university IT admin.”

This phishing campaign didn’t rely on generic spam. It was a spear-phishing operation—customized, timely, and extremely deceptive.

Faculty, staff, and student accounts across the university’s email system (hosted on Microsoft 365).

An email with the subject line:

“URGENT: Multi-Factor Authentication Update Required”

The sender? A spoofed domain—it-support@[university-name].ca
It looked legitimate. The signature matched internal email formats. There were no obvious typos.

The email instructed users to click on a link to reauthenticate their credentials or face “account suspension.”
The link led to a cloned Microsoft 365 login page that harvested usernames and passwords.

Once credentials were entered:

According to internal sources, the breach went undetected for 11 days.

“We thought we were secure. But we weren’t watching the most obvious attack surface—our domain.” — IT Admin, affected university

Canadian educational institutions are becoming prime targets in 2025. Why?

According to the Canadian Centre for Cyber Security, education now ranks in the top 3 most-targeted sectors for credential phishing and ransomware.

At YourDMARC, we specialize in helping educational institutions implement real-time, proactive email security.

→ Deploy DMARC, SPF, and DKIM with a "reject" policy so spoofed emails never reach inboxes.

→ Our platform would’ve flagged the attacker’s use of a near-identical domain and sent real-time alerts.

→ University IT could’ve reviewed email flow to catch anomalies—like sudden spikes in login attempts.

→ With DMARC, users can be confident that official emails truly come from the institution.

Want to avoid becoming the next headline? Here’s a simple blueprint:

Use tools like YourDMARC’s free checker to assess your email domain health.

Set it to “reject” once SPF/DKIM alignment is confirmed.

Simulate phishing attacks and teach staff how to identify red flags (urgency, links, sender domains).

Students are often the weakest link. Extend all protections to student accounts.

Monitor for signs like mass login attempts, password reset floods, or mass email forwarding rules.

Universities and colleges often think they’re “under the radar.” But attackers love low-hanging fruit.

If you’re not enforcing DMARC, you’re leaving the front door wide open to impersonation and credential harvesting.

Email is still the #1 way attackers get in. But DMARC is the #1 way to shut them down.

From domain enforcement to real-time spoofing alerts, YourDMARC protects institutions without adding IT complexity.

Ready to test your defenses?

👉 Schedule a Free Domain Risk Assessment

We’ll walk you through your vulnerabilities and show you exactly what needs fixing—no jargon, no pitch.

This real-world breach at a Canadian university is a wake-up call. Phishing isn’t just about bad links—it’s about trusted domains being used against their own people.

With credential harvesting on the rise in 2025, email compliance is no longer optional—it’s the backbone of any modern cybersecurity plan.