A phishing scheme designed to extract personal information from Penn affiliates has been circulating over email within the past 24 hours.
The scheme — detailed in an email from Information Systems Computing — looks similar to a secure Penn login screen. It asks for users’ PennKey, password, date of birth and Social Security number.
ISC’s email instructs those who receive an email with a link to the form to close their browsers and send the link to ISC’s office. Those who already received the email and entered their actual information should immediately change their PennKey password and inform ISC.
ISC has “identified numerous users who have indeed filled out the form with legitimate information,” according to the email.
There was recently another, similar attack. The email did not give any details of the earlier attack, but did say that the office “created a rule to detect this specific attack.”
ISC has not yet responded to requests for comment.
“The attackers are trying to gain credentials that would allow them specific access to Penn applications such as My Tax and My Pay, possibly for Identity theft as well as to have your paychecks sent to another banking account you don’t own,” the email read.
Anyone who receives the email is encouraged to contact ISC at security@isc.upenn.edu.
Check back for updates.