Information Security Announcements

Secure computing for the CCNY community requires that our users participate in making sure our campus computing is safe! By following certain protocols and procedures that are in place and by reading any Office of Information Technology e-mail broadcasts you will be using CCNY computing 'best practices'.

The Office of Information Technology (OIT) is steadily updating and adding information, posting guidelines and providing the means to achieve the goal of secure computing. Any office that will be using sensitive information from students, faculty or staff is required to fill out and file the appropriate form(s). All forms are to be submitted to and approved by the Office of the Chief Information Officer (CIO).

See below for a list of the Security announcements sent to the CCNY Community:

Cybersecurity Awareness Month: Enable MFA Everywhere (10/13/26)

Cybersecurity Awareness Month: Enable MFA Everywhere

Week 2: Enable MFA Everywhere (Oct 13)

Introduction

This week, we focus on Enable MFA Everywhere.

A password alone may not be enough to protect your accounts. Multi-factor authentication provides an additional layer of security by requiring another method of verification when you sign in.

At CUNY, MFA helps protect University systems and services. CUNY Login MFA is used for applications such as CUNYfirst and Brightspace, while Microsoft MFA protects access to Microsoft 365 services. Whenever MFA is available for your personal accounts, enable it there as well.

Helpful MFA Tips:

  • Enable MFA wherever it is available, particularly on accounts containing personal, financial, or sensitive information.
  • Never share your password or MFA passcode with anyone.
  • Never approve an MFA request you did not initiate, and carefully verify any number, location, or application information displayed before approving the request. For example, if you receive an MFA approval request when you are not trying to sign in, deny the request and report it to your college IT office. This could mean someone is attempting to access your account.
  • For Microsoft MFA at CUNY, set up more than one authentication method when possible so you have a backup if your primary method is unavailable. CUNY lists Microsoft Authenticator as the most convenient second-factor option.

MFA Resources:

Facts and Figures:

Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:

  • Awareness of multi-factor authentication (MFA) increased from 52% in 2021 to 77% in 2025.
  • Despite increased awareness, regular MFA use was only 53% in 2025.

Helpful Cybersecurity Tips:

Our emails and supporting information are available from the Cyber Security Awareness Month (NCSAM) page on the CUNY web site.

We also provide a growing security resources list on the CUNY Information Security pages. You may also want to visit the OUCH! website to read recent security articles or subscribe to its free security awareness newsletter designed for technology users.

If you have any questions about any of this information, please contact the CCNY Information Security Office at itsecurity@ccny.cuny.edu .

Cybersecurity Awareness Month: Use Strong, Unique Passwords and... (10/5/26)

Week 1 – Use Strong, Unique Passwords and a Password Manager (Oct 5)

Week 1 – Use Strong, Unique Passwords and a Password Manager (Oct 5)

Introduction

This week, we focus on "Use Strong, Unique Passwords and a Password Manager," an essential step in protecting your accounts and personal information.

Strong passwords are a foundation of online security. Using a strong, unique password for every account helps prevent one compromised password from putting your other accounts at risk. CUNY's Cybersecurity Best Practices recommend choosing strong and unique passwords for every account or application and never sharing your password.

A password manager can also make it easier to manage multiple strong, unique passwords by securely creating and storing them.

Helpful Password Tips:

  • Make passwords long: at least 13 characters (longer is better).
  • Use random strings or passphrases: combine unrelated words or mix letters, numbers, and symbols.
  • Create unique passwords for every account: never reuse the same one.
  • Create a memorable but strong password: Consider using a long passphrase made up of unrelated words that is easy for you to remember but difficult for others to guess.
  • Check for reused passwords: Review your important accounts and replace any passwords you have reused. Each account should have its own unique password.
  • Consider using a password manager: It can help generate and securely store strong, unique passwords.
  • Never Share Your Credentials: Never share your password, MFA codes, or any other authentication credentials with anyone, under any circumstances, including fellow students, faculty, staff, supervisors, subordinates, executives, contractors, vendors, or IT personnel. Legitimate support staff will never ask for your password or MFA code. If anyone requests or pressures you to provide your credentials, report the incident immediately to Student Affairs, Human Resources, or your Information Security Office.

Password Resources:

Facts and Figures:

Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:

  • 62% of respondents report regularly creating unique passwords, a decline from the previous year.
  • 41% of respondents never use a password manager.

Helpful Cybersecurity Tips:

Our emails and supporting information are available from the Cyber Security Awareness Month (NCSAM) page on the CUNY web site.

We also provide a growing security resources list on the CUNY Information Security pages. You may also want to visit the OUCH! website to read recent security articles or subscribe to its free security awareness newsletter designed for technology users.

If you have any questions about any of this information, please contact the CCNY Information Security Office at itsecurity@ccny.cuny.edu .

Launch of Cybersecurity Awareness Month (10/1/26)

Week 0: Launch of Cybersecurity Awareness Month

Week 0 – Launch: Don’t Make It Easy for Them (Oct 1)

Introduction

October is Cybersecurity Awareness Month, an international initiative that helps everyone take simple steps to stay safe online. This year's theme is “Don't Make It Easy for Them” — a reminder that building good cybersecurity habits and practicing them consistently can make life more difficult for cybercriminals.

CUNY is proud to support this effort in partnership with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA).

Throughout October, we will highlight five simple defensive behaviors across four weekly topics to help you stay safer online — no expertise required:

  • Week 1 – Use Strong, Unique Passwords and a Password Manager (Oct 5)
  • Week 2 – Enable MFA Everywhere (Oct 13)
  • Week 3 – Keep Software Updated (Oct 19)
  • Week 4 – Scrutinize Every Message (Oct 26)

Additional Resources:

Here are some helpful resources to strengthen your online safety practices:

Facts and Figures:

Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:

  • Awareness of multi-factor authentication (MFA) increased from 52% in 2021 to 77% in 2025, yet regular MFA use was only 53% in 2025.
  • Concern about cybercrime increased from 57% in 2022 to 68% in 2025.
  • 31% of participants believe losing money online is unavoidable, up from 25% in 2022.
  • Phishing accounted for 40% of reported cyber incidents in 2025.

Helpful Cybersecurity Tips:

Our emails and supporting information are available from the Cyber Security Awareness Month (NCSAM) page on the CUNY web site.

We also provide a growing security resources list on the CUNY Information Security pages. You may also want to visit the OUCH! website to read recent security articles or subscribe to it's free security awareness newsletter designed for technology users.

If you have any questions about any of this information, please contact your college's Information Security Manager.

Archives (6/4/24 - 1/13/20)

SPRING 2024

OIT-ISO NOTIFICATION: Tuesday, June 4, 2024 -Security Alert: Ongoing Phishing Attacks
Recently, our campus has been the target of numerous phishing attacks using a variety of fraudulent offers and notices. These attacks primarily target Students, Staff and Faculty with fake notices of account termination, fraudulent job offers, and fake requests from supervisors and other administrators to purchase gift cards. >>View Notice

OIT-ISO NOTIFICATION: Monday, January 29, 2024 - [THREAT ALERT] Multiple Active Email Phishing Attacks
Recently, our campus has been the target of numerous phishing attacks using a variety of fraudulent offers and notices. These attacks primarily target Students, Staff and Faculty with fake notices of account termination, fraudulent job offers, and fake requests from supervisors and other administrators to purchase gift cards. >>View Notice

FALL 2023

OIT-ISO NOTIFICATION: Monday, November 20, 2023 - Important Security Update: New End-Point Protection, Cortex XDR
In recent months, cyber-attacks disabled thousands of computers at other CUNY colleges, disrupting their business operations. We are anticipating an annual surge of cyber threats that typically occurs during the holiday season. In response to these hazards, in collaboration with CUNY, we are fortifying our information security measures. >>View Notice

FALL 2020

OIT-ISO NOTIFICATION: Friday, September 4, 2020 - [THREAT ALERT] Multiple Active Email Phishing Attacks
There is an active phishing email attack targeting City College student email accounts. One such campaign that rising in occurrence is one in which various work from home job offers are sent, working for faculty or for doctors or in well-known offices or organizations such as UNICEF and WHO. >>View Notice

SPRING-SUMMER 2020

OIT-ISO NOTIFICATION: [THREAT ALERT] Active Email Phishing Attack - May 1, 2020
There is an active phishing email attack targeting City College student email accounts. This attack has the subject line "FREELANCER/VIRTUAL ASSISTANT URGENTLY NEEDED" or "VIRTUAL ASSISTANT PT OFFER". >>See Notice

OIT-ISO NOTIFICATION: Secure Transfer - April 28, 2020
The Office of Information Technology would like to introduce the Secure Transfer portal, The OIT Information Security Office recommends exercising due diligence and caution in your cybersecurity efforts. >>See Notice

OIT-ISO NOTIFICATION: Video-Teleconferencing Hijacking Advisory - March 31, 2020
There are reports of video-teleconferencing being disrupted by pornographic and/or hate images and threatening language. These are known as VTC hijacking (Also called “Zoom-bombing”). >>See Notice

OIT-ISO NOTIFICATION:COVID-19 Related Phishing Campaigns--March 26, 2020
Malicious cyber threat actors are capitalizing on the global attention surrounding the novel 2019 Coronavirus (COVID-19) to facilitate scams, distribute malware, and send phishing emails. >>See Notice

OIT-ISO NOTIFICATION: Email Scams Advisory--March 2, 2020
This is a reminder to be alert to the innumerable online scams. One of the most prevalent is known as a “phishing” email. These emails are designed to look like legitimate emails originating from your bank, a friend, or even the United States government. However, they are a ruse to persuade you to download malicious software and/or reveal account credentials and personal information that can be used for identity theft. >>See Notice

OIT-ISO NOTIFICATION: Email Scams Advisory--February 7, 2020
This is a reminder to be alert to the innumerable online scams. One of the most prevalent is known as a “phishing” email. These emails are designed to look like legitimate emails originating from your bank, a friend, or even the United States government. However, they are a ruse to persuade you to download malicious software and/or reveal account credentials and personal information that can be used for identity theft. >>See Notice

WINTER SESSION 2020

CUNY-CIS Security Advisories: FBI FLASH Report – Website Defacement Activity Indicators of Compromise and Techniques Used to Disseminate Pro-Iranian Messages – TLP: GREEN--January 13, 2020
Following last week’s US airstrikes against Iranian military leadership, the FBI observed increased reporting of website defacement activity disseminating pro-Iranian messages. The FBI believes several of the website defacements were the result of cyber actors exploiting known vulnerabilities in content management systems (CMSs) to upload defacement files. The FBI advises organizations and people concerned with Iranian cyber targeting be familiar with the indicators, tactics, and techniques provided in the attached file.

CONTACT INFORMATION

IT Security Office
e: servicedesk@ccny.cuny.edu

Service Desk
Location: North Academic Center (NAC)
Room: NA 1/301
p: 212-650-7878
e: servicedesk@ccny.cuny.edu

Last Updated: 10/08/2026 17:30