MacEwan University in Edmonton has been defrauded of $11.8 million in a so-called phishing attack.
The university says workers were fooled by a series of fake emails asking them to change electronic banking information for one of the school's major vendors.
The change resulted in the transfer of nearly $12 million into a bank account staff thought belonged to the vendor, but on Wednesday, officials found out they had been scammed.
University spokesman David Beharry says most of the funds have been traced to accounts in Canada and Hong Kong.
Beharry says the university has conducted an interim audit of business processes and controls were put in place to prevent further incidents.
He says the university's computer systems have not been compromised, but a preliminary assessment has determined that controls around the process of changing vendor banking information were inadequate.