Last night, the Federal Bureau of Investigation (FBI), Cybersecurity & Infrastructure Security Agency (CISA), and Department of Homeland Security (DHS) issued an advisory which details a credible and imminent threat of ransomware against healthcare and public health sector entities.
IU and IU Health are closely linked in many of our systems, networks, and applications. Additionally, several hospital systems around the U.S. have already been impacted. The most common avenue for this attack is through fraudulent email, also known as phishing.
Due to the increased and widespread potential harm of such an attack, we are again asking for your continued vigilance to protect IU. Please bear the following in mind when dealing with email messages:
- Recognize—Verify the sender by hovering or right-clicking on the sender’s name to view the real email address. Check for a digital signature. Look for the trusted security footer on official IU email. Official IU messages should have one or more of these trust indicators.
- Rethink—Hover over any included links to discover the real URL. If you don’t recognize the sender, do not interact further with the message, including opening hyperlinks or attachments. If you recognize the sender, ask yourself if they would normally send this type of message. Consider contacting them via a different means (phone, IM).
- Report—If you believe the message is a phish, or you believe it’s suspicious but aren’t sure, send the message with full headers to phishing@iu.edu or use the PhishMe Reporter. If installed, the PhishMe Reporter for Outlook can be found in the ribbon bar near the top of the window.
Remember, malicious actors will often lure you into acting by sending legitimate looking messages that seem too good to be true or which instill fear and panic. To learn more about how to protect against phishing attacks, please visit the IU Knowledge Base.
You are our best line of defense against malicious actors.
