He says that many colleges have been targeted by Sci-Hub. In one case at Marquette, a professor received an email stating that he or she needed to update his or her university user name and password by following a link. Once on the site, which was actually in New Zealand, the faculty member typed in new credentials, which were then captured by what the publisher later linked to Sci-Hub.”Then you start seeing your downloads going to unusual locations or downloads that are occurring in huge quantities — thousands of downloads,” Mr. Sanchez says.Typically, the publisher notices such irregularities first, notifies the college, and tells it to shut down the problem quickly. At Marquette, additional layers of security were added, the IP addresses of the compromised accounts were given to the publisher, and the faculty member changed the user name and password within 24 hours. But, Mr. Sanchez says, “it puts us in a tough situation.”

Source: Librarians Find Themselves Caught Between Journal Pirates and Publishers – The Chronicle of Higher Education