Students Locked Out of Exams Days Before Finals

CEDAR HOLLOW, Ont. — November 10, 2026 — The text arrived at 11:47 p.m., twelve hours before Maya Chen’s first final exam. It said her exam room had changed, and gave her a link to confirm the new one. Chen, a first-year student at Cedar Hollow University, tapped it, typed in her student login, and went to sleep. By morning, her password no longer worked — and neither did the logins of more than two hundred of her classmates.

The link did not lead to the university’s exam portal. It led to a copy, built to look like the real one down to the crest, the colours, and the “confirm your exam schedule” button. Students who signed in handed over their usernames and passwords. Within hours, the attackers had used those logins to change the passwords, locking the real owners out of their exam schedules, course pages, and student email — days before final exams begin.

More than two hundred students lost access to their exams in a single night — and none of them had clicked anything unusual.

The messages arrived as texts and emails, timed for the night before exam week, when students were already anxious and checking their phones late. Each one warned of a changed exam room or a schedule update, and each one linked to the copycat portal. The university says its real exam portal never sends schedule changes by text, and never asks students to log in from a link in a message. But at midnight before finals, few students stopped to check.

“I did what the message told me to do, because it told me to do it the way the university always does,” Chen said. “It had the exam schedule, it had my course code, it even had my professor’s name. I thought I was being responsible. Then I woke up locked out of everything.”

Cedar Hollow University says it has reset the affected accounts, restored access to exam schedules, and confirmed that no exam has been missed. But the university’s IT director, Priya Sandhu, said the lockout was the point — not a side effect. “The attackers didn’t want the passwords for their own sake,” Sandhu said. “They wanted the accounts. A student account opens the exam portal, the email, the library, the financial aid page. Lock the student out, and you hold everything they need for exam week.”

A student login is a master key — and this one opened every door the university has.

Student accounts are a soft target precisely because they unlock so much with a single sign-in. One username and password reaches the exam schedule, the grades, the email, and in many cases the financial aid and fee records. Students reuse those passwords elsewhere, share them with study groups, and rarely turn on multi-factor authentication. And during exam week, a message about a changed exam room arrives at the exact moment a student is least likely to question it.

“Attackers don’t need a sophisticated hack when the calendar does the work for them,” said Daniel Okafor, a fictional cybersecurity advisor who works with colleges on account security. “Exam week is the one week of the year when every student is expecting an urgent message from their university, and every one of them is too tired to check the sender. The portal didn’t have to be perfect. It only had to arrive at midnight.”

In this fictional case, the copycat portal stayed live for nine days before it was taken down. The university says it has since forced a password reset for all students, turned on multi-factor authentication for exam portal access, and is warning students to reach the portal only by typing the address themselves — never from a link in a text or an email. It has not said how many accounts were harvested in total, or whether any student’s financial information was reached.

The fictional students say they have since changed how they treat their university logins. Passwords are unique to the university account. Multi-factor authentication is on. And no exam message is ever trusted from a link — the schedule is checked by opening the portal directly, the same way every time.

The defence is not a sharper eye for fake portals. It is never logging in from a link at all.

That advice applies well beyond one campus. Across Canada, colleges and universities all run portals that hold a student’s exams, grades, email, and aid behind a single login — and a copycat needs only a well-timed message to stand beside the real thing. The defence is not a cleverer warning email. It is a habit of typing the address yourself, and of treating any login link in a message as untrusted until the university confirms it.

For students, the checklist is short: never log in from a link in a text or email, even one that looks like it came from your school; give your student account its own password and turn on multi-factor authentication; and if a message says your exam changed, check the portal by opening it yourself. For universities, it is equally simple: never send login links by text, publish the real portal address everywhere, and take copycat portals down the same day they appear.

The fictional students say the copycat portal has been taken down, and the real Cedar Hollow University exam portal is unchanged.

The passwords were never the students’. The accounts were never the attackers’. And the difference — one login, typed in directly instead of tapped from a message — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.