Phishing Campaign

System Admin

September 2, 2026

FOR IMMEDIATE RELEASE

Date: September 2, 2026

Unicoi County Schools:

Unicoi County Schools Issues Security Alert Regarding Community-Wide Credential Phishing Campaign

ERWIN, TN — Unicoi County Schools is issuing a security alert to staff, students, parents, and community members regarding an ongoing, external phishing campaign affecting our region, along with guidance on protecting personal digital accounts.

Origin and Scope of the Incident

According to our logs, the incident originally entered the school district from an external, non-district source when a staff member received a fake login prompt (credential phishing) sent from outside the @unicoischools.com domain. Once the staff account was compromised, the attacker used it to send a mass phishing email titled "joyful gathering on September 6th!" to district staff, student accounts (@students.unicoischools.com), and external community addresses.

The email instructed recipients to click a link to download a file named ScreenConnect under the guise of an "RSVP" for an upcoming event.

Warning Regarding Other Community Senders

Our investigation indicates this phishing campaign was directed at the broader region, not just the school district. If you or someone you know received a similar email prompting you to download a ScreenConnect client or RSVP link from another local individual, business, or organization, those accounts were likely compromised in the same initial wave of attacks. Recipients should treat any similar unexpected invitation emails from known contacts with extreme caution.

Immediate District Response

  • Account Isolation: The compromised staff account was immediately disabled, and all active authentication sessions were terminated.

  • Network Security: Administrative security controls on district-managed devices successfully blocked the malicious ScreenConnect file from running on school equipment.

  • System Integrity: Core student databases, grade portals, and sensitive district records remain secure and uncompromised.

Critical Safety Steps for Community Members

Unicoi County Schools strongly encourages all community members, parents, and students to take the following actions:

  • Do Not Download or Run the File: If you received an email asking you to download a ScreenConnect file to RSVP for an event—whether from a school district address or any other sender—delete the email immediately.

  • Scan Home Computers: If you downloaded or attempted to run a ScreenConnect.ClientSetup.exe file on a personal home computer, run a thorough scan immediately using your home antivirus software.

  • Enable Two-Factor Authentication (2FA): Activate 2FA/MFA on all personal email, banking, and social media accounts to prevent unauthorized access even if your password is stolen.

  • Verify Login Prompts: Be cautious when asked to log in after clicking an email link.  Always visit the site that you know and login, don't just use the email link.   Always check the browser address bar to ensure you are on an official website before entering credentials.

  • Change Reused Passwords: If you entered your credentials on a link provided in a suspicious email, change your password immediately on the official service website.

Unicoi County Schools appreciates the community's collaboration as we work to keep our digital environment secure.