Spear Phishing Incident Response Guide for University Student Insurance Programs

A targeted phishing message can give an attacker access to university email, insurance administration systems, or sensitive student information. A fast, coordinated response helps contain the attack, establish what may have been exposed, and protect students from follow-up fraud.

Use this guide to coordinate campus IT and security teams, student insurance staff, privacy officials, and the insurance administrator. Follow your institution’s incident-response procedures; the right legal and notification requirements depend on the organizations involved and the information affected.

Identify Spear Phishing Targeting Student Insurance Programs

Spear phishing messages are tailored to a person, role, or organization. A message may appear to come from a university administrator, insurance carrier, student, or benefits vendor and refer to open enrollment, a claim, a premium payment, or a plan change.

Look for warning signs such as an unexpected request to sign in, share student records, change payment details, open an attachment, or act urgently. Check the full sender address and the actual destination of links. A familiar display name or a convincing reference to campus business does not prove that a message is genuine.

Do not reply, open attachments, follow links, or provide passwords or verification codes. Verify unexpected requests using contact information you already know to be legitimate, such as a number in your campus directory or on an insurance card. If you are unsure, report the message before taking action.

Report Suspicious Messages Through Campus Security Channels

Use your university’s designated phishing-report button or campus security reporting channel as soon as possible. If you cannot find one, contact the IT security help desk or security operations team through a known campus phone number or official internal portal. Tell them if you clicked a link, opened a file, entered credentials, or approved an unexpected sign-in request.

Preserve the message and, if possible, report it using the approved method that retains its original headers. Include when it arrived, what action you took, and any relevant account or device details. Avoid forwarding messages containing student health plan data through unapproved email or chat channels.

If the message reached several people, notify the campus team so they can determine whether it should be reported more broadly. Do not warn others by forwarding the suspicious message; security staff can share a safe alert and instructions.

Respond to Compromised Accounts and Devices

If you entered a password or verification code, report it immediately. From a device you believe is safe, change the affected password and any reused passwords, and follow the security team’s instructions to revoke active sessions, reset multifactor authentication, and review account recovery settings. These steps are part of credential compromise remediation; changing a password alone may not end an attacker’s access.

IT staff should check for suspicious sign-ins, mailbox forwarding rules, delegated access, newly authorized applications, and changes to account recovery details. They should also review whether the account accessed shared drives, insurance portals, or other systems and revoke unauthorized access where appropriate.

If you opened a file or installed anything, contact IT before continuing to use the device for sensitive work. Follow instructions for isolating it from networks and preserving evidence; do not delete files or attempt your own cleanup unless the response team directs you to do so. If the incident involves an insurance administrator’s account or system, contact the administrator through a previously verified channel and coordinate containment.

Assess Potential Exposure of Student Health Plan Information

A compromised account does not by itself establish that student information was viewed or taken. Investigators should determine which accounts and systems were accessed, what the attacker could reach, whether files or messages were opened or downloaded, and how long the access may have continued.

Depending on the program and administrator, records could include student names and contact details, plan or member identifiers, enrollment and eligibility information, claim details, or other health-related information. Do not assume every category was involved: confirm the actual data and affected people using system logs, records, and information from the insurance administrator.

Document the timeline, accounts, systems, data categories, access evidence, and containment steps. Coordinate with campus privacy and legal officials and the plan administrator to assess protected health information safeguards and any other applicable duties. Student insurance arrangements do not all have the same legal status, so qualified officials should determine which privacy and incident notification requirements apply.

Verify Insurance Incident Notifications Independently

Students and staff who receive an incident notice should verify it without relying on the message’s links, phone numbers, or attachments. Visit the university’s known portal by typing its address yourself, use a number on the insurance card, or contact the campus office through a trusted directory. Ask whether the incident is real and whether the message was sent to you.

A legitimate notice should explain what happened, what types of information may be involved, what steps recipients can take, and how to reach the responsible organization. If anything is unclear, confirm the details through an independently obtained contact method before sharing information or taking action.

Never provide a password, one-time verification code, payment, or sensitive personal information in response to an unexpected message. If you already supplied information, contact campus IT or the plan administrator through a verified channel and explain exactly what you shared.

Warn Students About Fraudulent Credit Protection Offers

After a reported incident, scammers may pose as campus staff, insurers, credit-monitoring providers, or identity-protection companies. They may use fear or urgency to request payment, account credentials, verification codes, or personal details—or to sell services by falsely claiming they are required.

Tell students to verify any offer with the university or insurance administrator using a known contact method. They should not pay an unsolicited caller or use a link in an unexpected message to enroll. If an official notice offers a protection service, students can confirm the offer and its terms directly with the organization named in the notice.

Respond promptly through trusted campus channels, contain compromised accounts, investigate what information was actually accessed, and verify any insurance notice independently. Clear communication can help students avoid follow-up scams while the university and plan administrator address the incident.

FAQs

What should university staff do after receiving a spear phishing email?

Do not reply, click links, open attachments, or provide information. Report the message through the university’s phishing-report button or campus security reporting channel. Tell IT if you interacted with it, and preserve the message using the institution’s approved reporting process.

What steps should be taken if an employee entered their credentials?

Report the incident to campus IT immediately. From a safe device, change the affected password and any reused passwords, then follow IT’s instructions to revoke sessions, reset multifactor authentication, and check account recovery settings. The security team should investigate account activity and access to connected systems.

What student insurance information could be exposed in a phishing incident?

Potentially accessible information depends on the compromised account and systems. It could include student contact details, plan or member identifiers, enrollment or eligibility information, claim details, or other health-related records. Investigators should establish which information was actually accessed or acquired rather than assume all records were exposed.

How can students verify whether an insurance incident notification is legitimate?

Contact the university or insurance administrator using a phone number on the insurance card, a known campus directory, or a portal reached independently. Do not use the message’s links or phone numbers until the notice is confirmed, and never share passwords or verification codes in response to it.