24/7 Wall St.

Harvard University has enough trouble as a case about racial discrimination in its admissions policy goes to court. Today, it sent an email to graduates and faculty warning that some of Harvard’s own email addresses had been hacked.

[in-text-ad]

Alumni with @post.harvard.edu or @alumni.harvard.edu addresses were warned about phishing. The university’s advice:

First, do not pay the ransom.

Second, if a password is mentioned in the email, change the password mentioned anywhere it is still in use.

Third, delete the phishing message you received. Do not click on any links in it or open any attachments that might have been included. This is how the phishers collect more personal data.

The university recommended that people use unique passwords on each site where they must have one. This would include sites like Netflix, Amazon.com or travel booking sites. Another suggestion is that people use password management to enable two-factor/two-step features on personal accounts where it is offered.

As a guide, the university described the breach further:

[T]he scams we’re seeing now are variants of a known phishing attempt where the people contacting you get your password from well-known data breaches and then use it to make you believe your computer or other personal account has been compromised. In this type of scam phishers include one of your legitimate passwords (current or past) in their email to you, making you more likely to engage. In reality, this password was unearthed during a previous data breach that may even be years old.

People with Harvard educations should know that already.