In a recent Private Industry Notification to the higher education sector, the FBI warned that U.S. college and university credentials are being advertised “for sale on online criminal marketplaces and publically [sic] accessible forums.”

The Notification warns that the exposure of credentials and network access information, “especially privileged user accounts, could lead to subsequent cyber-attacks against individual users or affiliated organizations.”

One of the threats listed included that:

As of January 2022, Russian cyber criminal forums offered for sale or posted for public access the network credentials and virtual private network accesses to a multitude of identified US-based universities and colleges across the country, some of which included screenshots as proof of access. Sites posting credentials for sale typically listed prices varying from a few to multiple thousands of US dollars.”

The FBI recommends that colleges and universities stay in close contact with the Bureau so it can assist in the event of an attack. It also provides a list of 11 bulleted items to mitigate the risk.