Are Your Student's University Email and Files Safe? What College Families Need to Know

Cybercriminals have been breaking into email systems used by universities across the United States and Canada. They exploited a security flaw in Roundcube, an email program that many colleges use. The hackers specifically targeted academic researchers, stealing their login credentials and installing secret spying software on the university servers.

This affects students, faculty, and staff at universities that use Roundcube for email. If your student attends a U.S. or Canadian university, their email account could potentially be compromised. The attackers can read emails, steal passwords, and access any files or research stored in university accounts.

Anyone who uses their university email for personal matters, like password resets for other accounts, faces additional risk. If you or your college student use university email, take these steps right away.

1. Change your university email password immediately through your school's official portal.
2. Enable two-factor authentication on your university account if it is available. Contact your school's IT help desk if you need assistance.
3. Change passwords on any other accounts where you used the same password as your university email.
4. Watch for suspicious emails that appear to come from your university, especially ones asking you to click links or provide login information. Beyond this immediate threat, make sure your student understands basic email safety. Never reuse passwords across multiple accounts, especially for important services like email, banking, or social media. Use a password manager to create and store unique passwords for every account. Be suspicious of any email asking you to click a link or download an attachment, even if it appears to come from the university. When in doubt, contact the IT department directly using a phone number from the official university website, not from the email itself.