An Edmonton university says it was the victim of an email “phishing attack” that resulted in the transfer of $11.8 million to a bank account staff believed belonged to a vendor.

MacEwan University said “inadequate” controls on banking information played a role in the fraud, which was discovered Aug. 23.

The fraud involved three transactions of varying amounts, the university said. Several opportunities to identify the fraud were missed.

Most of the money — more than $11.4 million — has been traced to accounts in Canada and Hong Kong, the university said in a news release Thursday.

Read more at CBC News