Johns Hopkins IT warns of rise in phishing attempts, including phone call scams

Members of the Johns Hopkins community are encouraged to stay vigilant in light of a significant rise in the volume and sophistication of phishing messages targeting Johns Hopkins, as well as recent high-profile data theft attempts and breaches affecting higher education nationwide.

As technology continues to advance, so do the methods that scammers and hackers use to target individuals and institutions. Phishing attempts may be received via email or via phone call. Importantly, no one from Johns Hopkins will ever call or email you to ask for your password or multi-factor authentication (MFA) code. If you receive a call of this nature, it's a scam. This includes calls from individuals posing as members of the Johns Hopkins IT Help Desk.

Cybersecurity is not merely the responsibility of the IT department—students, faculty, and staff also help keep the institution's digital environment safe. Simple steps such as being cautious with suspicious emails, not auto-forwarding email to a personal account, and never sharing personal information can make a big difference.

Stay alert for unexpected messages, phone calls, or links that ask for sensitive information. If something feels off, trust your instincts and report it to the IT support team right away.

Johns Hopkins IT recommends all employees protect themselves by following some basic guidelines:

• Don't send passwords or any sensitive information over email.
• Don't click on "verify your account" or "login" links in any email.
• Don't reply to, click on links in, or open attachments in spam or suspicious email.
• Don't call a phone number in an unsolicited email or give sensitive data to a caller.
• Don't accept a Microsoft Teams chat from an unknown external individual.
• Do be cautious about opening attachments, even from trusted senders.
• Do look at the From email address.
• Do look at the Reply address to ensure it matches the From address.
• Do send impersonated or suspect email as an attachment to IT. The address is spam@jhu.edu.