[stevemclaugh]

Thanks for this.

These cases may or may not be phishing. When corporations are hacked for their user credentials, those databases sometimes end up in dark web markets. It would be easy to extract email addresses with .edu domains ... so if a student used their university address for some service and reused the password, there's your login.

Moral of the story: Encourage students to use a password manager and 2FA.