Original Phishing Message

Note: If you received this message, please simply delete the message. Do not click any links and do not enter or reply with any information.

Tips for Detection

• Notice the “Caution” banner that was applied to the top of the message. Technology Services adds the banner on emails that match patterns of previous phishing attempts.
• The sending email address is from the cornwallhospital[.]ca domain. This is not a Puget Sound address.
• The link in the email leads to ithelpsurveyinvitationportal[.]godaddysites[.]com which is not a Puget Sound site.
• Technology Services does utilize a ticketing system. Any legitimate survey request or ticket update will come from an @pugetsound.edu address and links in those emails will begin with https://kbox.pugetsound.edu.

Where did the link lead?

The link led to a fraudulent survey portal that asked for your username, email, and password. Note: If you entered your credentials on this page, please immediately change your password and contact the Service Desk at x8585. Your credentials are likely compromised.

Text of Phishing Message

From: Sonya.Marleau-Bonacci[@]cornwallhospital[.]ca
Subject: E: ITHelp Survey invitation

You have been invited to take a Satisfaction survey for a recent IT-Help ticket.
here to take your survey
To view your survey queue at any time, sign in and navigate to Self-Service > My Assessments & Surveys.

Additional details about this Survey are:
Number #: INC1798292
Short Description: HELP-DESK ALERT.
Description:
Resolved Date: Today
Ref:MSG5211182