What You Need To Know About Phishing

Have you ever received a phishing email?

Chances are, you have. Over the past month we’ve blocked 17,454 messages sent to Carilion email addresses that had malicious links or attachments. 

Phishing emails are not always easy to spot. In August, we sent a “test phish” to all Carilion employees, and 41 percent clicked on the link within the email. Of the 41 percent who clicked on the link, 80 percent entered their credentials. It only takes one person falling for a phish to allow cybercriminals to access our network – which is why we must stay vigilant.

What You Need To Know About Phishing

Cybercriminals use email messages that are designed to look like they are coming from a person or business you are familiar with. The messages are designed to trick you into doing things such as:

• Sharing your username and password
• Clicking on a link that infects your computer with a virus
• Downloading an attachment that infects your computer with harmful software

Once they have this information, cybercriminals may:

• Steal your personal information
• Steal money from your paycheck or bank account
• Take control of your computer or the Carilion network and ask for “ransom”
• Gain access to your computer network, emails, files and resources, such as patient information
• Use your email account to “spoof” your email system and send phishing or spam emails to the people in your contacts list

Be Vigilant! How to Spot a Phish

Phishing emails aren’t always easy to spot, but here are some clues that an email might be a phish:

• It asks you to take immediate action.
• It is written in a threatening way or promises something that seems too good to be true.
• It asks you for sensitive information, such as a username/password or account number.
• It contains misspellings or grammar mistakes.
• It asks you to click on a link or links that don’t appear to match up with the organization that is contacting you.
• It appears to be from someone within Carilion, but the email has the yellow banner at the top.
• It appears to be from a department that does not match Carilion’s structure, such as the "IT department" instead of TSG.

How to Report a Suspected Phishing Email

If you receive an email that looks like a phish, forward it as an attachment to phishing@carilionclinic.org.

If you believe that you have fallen victim to a phishing scam, disconnect your computer immediately and report the incident to the Technology Service Center through Edison or by calling 540-224-1599 (71599).

Questions?

If you have questions, contact Chief Compliance Officer Vicki Clevenger at 540-510-4600 or privacy@carilionclinic.org.