Ray Cool, an assistant professor of health, physical education and recreation at Western Michigan University, will be reimbursed after his paycheck was stolen by hackers, he said Monday. The news came a day after MLive reported that the university had not reimbursed Cool for the paycheck, which was stolen in mid-December. A hacker using a computer in New Mexico accessed Cool's university account and changed the routing number for his direct deposit from a local credit union account to one in Utah. By the time university public safety detectives traced the hack, all that was left in the Utah account was $11 -- some $1,500 short of his paycheck (the amount does not reflect his actual salary; Cool has several automatic deductions, such as to a retirement account, that were apparently unaffected by the theft).
In response, the university offered Cool an advance on his next paycheck but did not reimburse him for the missing check. Cool said he was frustrated by the university's stance, as it was their system that had been breached. But on Monday, the university informed him via email that he would be "made whole" financially, he said. Going forward, Cool said, "They need to make sure the system protects faculty and staff."
Cheryl Roland, a university spokeswoman, said in an email that she did not know how the hack occurred, but suspected it was the result of an organized phishing attempt. The university's backup verification system picked up on the problem and sent emails to both Cool and a second victim, a university staff member who also has been reimbursed, telling them their bank routing numbers had been changed, she said. But neither Cool nor the second employee opened the message until after the funds had been diverted, a week later. The university has indefinitely suspended online changes to direct deposit information, Roland added.