When I first started at my current place of employment, cybersecurity was never mentioned or talked about. In fact I'm not sure it was on anyone's radar other than the guy who is now head of IT, but at the time was a bit lower on the totem pole. As an example, I was there well over a year before there was a mandatory password reset and apparently it was the first that had been done in years(happened right after our current head of IT took the job). Many places will require a password change every 30, 60, 90, or 180 days(or at least some regular schedule) depending on how sensitive of data you're working with. As a college, and primarily a teaching college, all faculty and many employees interact with regularly federally protected information(as per FERPA for most and a few other statutes for a select few like Title IX and HIPAA). There were several other relatively loose practices like giving users administrative access on their work-provided Windows systems(never a concern for me since I've always used a personally-provided Mac, but that's a different discussion).
Loose security caught up to us right before Thanksgiving in 2021 when we were hit by ransomware. It crippled us. There was talk of ending the semester early. We were closed for nearly 2 weeks while they restored some basic level of functionality, but even once we were back up some pretty fundamental things like faculty/staff email weren't working(it's on a local Outlook 2007 server-student email is on the cloud-based Office 365 server, so they were back up once our single sign on server functioned, and students couldn't make sense of why their email worked and ours didn't). Even things like copiers took a while to come back, as all are "locked" by a keycode box to charge the appropriate account, and the server backing that was a lower priority(we had to walk things to the print shop across campus). It really was probably March of 2022 before we were back to 100%, and I'd say the end of 2022 before they had all the lingering bugs worked out. BTW, they didn't pay the ransom-they restored everything from back-up, and fortunately the attackers weren't malicious enough to plant the bug a few weeks/months ahead of time as they sometimes do(some orgs don't even keep backups that far back, or if they do it would mean a lot of data loss).
Long story short though, they finally this fall made us actually do Cybersecurity training, and Phishing/Smishing(SMS phishing type attack) were covered. We had a phishing "test" in the spring-I caught it right away and reported it, but something like 50% of people actually clicked on the link.
This one showed up in my inbox the other day. It's 100% phishing, and I suspect an IT test. Regardless I reported it. It could seem legit, but I've also never had a Spotify account and even if I did I wouldn't have used my work e-mail so I knew 100%.
BTW, for years now-probably since I was in college and learned about Phishing in the mid to late 2000s, I've NEVER clicked on links in emails that prompted me to reset passwords or enter any other information. If it is a legitimate issue, any respectable company will offer you the same information if you go directly to their site by the usual/official means(i.e. typing
www.amazon.com into your browser), logging into your account from there, and correcting the issue. If it's banking or credit card related, you can also call your bank or call the number on the back of your card and, again, if there's really an issue they will help you.
On a desktop too, and our training made a big deal about this but it's not something I normally do, you CAN hover over the link and see where it really takes you.
Doing so with both live links gives me this
Those are definitely not Spotify links, but do look like a "catch" for a phishing test
Also, I don't see any spelling or grammar errors, something that can often tip you off, but the wording of this feels...awkward...and set my spidey senses tingly regardless of, again, not having a Spotify account.
Be smart and be safe out there, folks. This sort of stuff is an easy way to have your identity stolen, and if this is on your work email it could be a way to find yourself unable to do your job or in extreme cases without a company to work for(more than a few places have closed up shop after a cyber attack-another college decided to do just that as a result right around the same time as ours happened).
