Report a suspected phishing email or security incident

Report suspicious activity promptly, even when you are not certain it is malicious.

Examples

• A phishing message or unexpected attachment
• An MFA prompt you did not initiate
• A password-reset notice you did not request
• A lost or stolen device
• Unusual sign-in alerts, sent messages, or account changes
• Ransomware warnings or files that suddenly became unreadable

Immediate steps

1. Stop interacting with the message, link, attachment, or device.
2. Do not reply, forward the suspicious message normally, or delete it.
3. If you entered a password or approved an MFA prompt, state that clearly in the ticket.
4. If a computer shows ransomware or active compromise, disconnect its network cable or Wi-Fi if you can do so safely, but leave the device powered on.
5. Open a ticket under Security Incident or Suspicious Activity from a different trusted device when possible.

Include the affected user, device, time observed, and what actions were taken. Never send passwords or MFA codes.