If you get an e-mail asking you for personal information, don’t respond. You may be putting not only yourself, but the whole school at risk.

Information security officer Bryan McLaughlin said Creighton has been subject to “spear phishing” attacks. E-mails are being sent from a source outside Creighton to certain portions of campus. The e-mails are disguised to look like they’re official Creighton e-mails from groups like mail administration or Webmail administration.

“It’s really been since school started this semester where we’ve seen this problem,” he said. “They’re really targeted at Creighton, they look official and … typically they say your account’s going to end unless you reply to this message … with your net ID and password.

“What happens is, when people respond to those with their ID and password, typically within about six hours, somebody else logs into their CUmail account and uses that to send out spam.”

A lot of the time the e-mails will contain false information and poor grammar, but they come from a Creighton address and sometimes will include a fake e-mail address where someone can ask questions.

“People see that and say, ‘Oh, well, it must be real, it has a Creighton e-mail address in there,'” McLaughlin said.

Within less than an hour after the spam is sent out, the large Internet Service Providers, such as Yahoo! and Comcast, start blacklisting Creighton accounts so Creighton e-mails can’t reach their accounts. When Creighton gets blacklisted, the Division of Information Technology has to petition the ISP to take Creighton off the blacklist by showing what it has done to resolve the issue. It usually takes about a week to get off the blacklist, McLaughlin said.

Aside from students not being able to contact family and friends via e-mail, McLaughlin said being blacklisted creates problems for admissions in recruiting and for faculty who are trying to conduct research. Also, parents can’t get into N.E.S.T.

McLaughlin said DoIT can’t stop phishing attacks from occurring, nor can it stop people from being taken by them. He also said no one is blacklisting Creighton right now, but it only takes one person giving out his or her information for it to potentially happen again.

“If it asks for your password, or other personal information, it’s not a legitimate e-mail,” McLaughlin said. “Creighton will never ask for your password, and if they do, it’s not legit. Period.”