Security
December 1, 2025
Employee benefit advisor contact
Denison Security
Denison’s cybersecurity intelligence has been made aware of a financial scam targeting faculty, administrative staff, and support operating staff. If you receive a suspicious message, please forward it to isitsafe@denison.edu.
What is the message trying to steal?
The message attempts to steal sensitive personal information, including social security numbers.
What do I do if I get a malicious message?
- Do not click links, call phone numbers, or reply to the message.
- Do not give your personal information.
- Report the message to Is It Safe by forwarding it to isitsafe@denison.edu.
How can I tell the message is malicious?
Denison’s ONLY partners for employee assistance are ComPsych (through the Employee Assistance Program, or EAP) and TIAA. You may receive legitimate communications from TIAA about your retirement accounts.
If you aren’t sure whether a message is malicious or not, forward it to isitsafe@denison.edu.
The message subject might contain a claim about being a retirement planner, asking you to set up a meeting with them.
Some example subject lines include:
- Interested in setting up your plan review
- Would you like to set up your pension appointment?
- Still options to book your retirement check-in
- Options remain to book your savings appointment
- Closing out – book your plan review
- Reminder to book your plan check-in
- Last chance to set up your plan session
We have observed the suspicious email originating from many domains, including:
You can limit who can add events to your Google Calendar.
- addpensionmax[.]com
- addpensionzone[.]com
- advantahealthcore[.]com
- benefitadvisorystrategieshq[.]com
- benefitconsultantsplatformhq[.]com
- benefitconsultantsstrategists[.]com
- benefitconsultgrouphq[.]com
- benefitconsultinggrouphq[.]com
- benefitconsultpartnershq[.]com
- benefitexpertsstrategieshq[.]com
- benefitmanagementadvisorshq[.]com
- benefitmanagersstrategieshq[.]com
- benefitmgmtteamhubhq[.]com
- benefitprimeglobal[.]com
- benefitsconsultantshub[.]com
- benefitsconsultingfirm[.]com
- benefitsconsultinggrouphq[.]com
- benefitsconsultingteamhq[.]com
- benefitsreviewexperts[.]com
- benefitsstrategyhub[.]com
- benefitstrategicgroup[.]org
- benefitvisionnetwork[.]com
- consultingemployeebenefits[.]com
- ebgbenefitsteamhq[.]com
- ebgconnectconsultants[.]com
- ebgconnectgroup[.]com
- ebgconnecthub[.]com
- ebgconnecthubhq[.]com
- ebgconnecthubsolutions[.]com
- ebgconnectservices[.]com
- ebgconsultinghub[.]com
- ebgproshub[.]com
- ebgstrategyhq[.]com
- ebgworldstrategies[.]com
- empbenefitzone[.]com
- employeebenefitconsultinghq[.]com
- employeebenefitleaders[.]com
- employeebenefitnetworking[.]com
- employeebenefitsbizhq[.]com
- employeebenefitsconsulthq[.]com
- employeebenefitsgroup[.]net
- employeebenefitshubhq[.]com
- employeebenefitsmanagementgrouphq[.]com
- employeebenefitsolutionshub[.]com
- employeebenefitsolutionshubhq[.]com
- employeebenefitspartnershq[.]com
- employeebenefitsplanconsultantsgroup[.]com
- employeebenefitsplanninghq[.]com
- employeebenefitsreportshq[.]com
- employeebenefitsreviewshq[.]com
- employeebenefitssolutionsnetwork[.]com
- employeebenefitsteamhq[.]com
- employeebenefitstrategisthq[.]com
- employeebenefitsupportservices[.]com
- employeeplanexpertshq[.]com
- forthrightcps[.]com
- getbenefitscounsulting[.]com
- getstrategistcore[.]com
- getstrategistlink[.]com
- getstrategistplex[.]com
- getstrategistzone[.]com
- getworkbenefits[.]com
- gonetworkconsultant[.]com
- insightpensiongroup[.]com
- legacyretirementconsulting[.]com
- nationalconsultingstrategists[.]com
- nationalpensionstrategygroup[.]com
- nationalretirecore[.]com
- nationalstrategistsplanhq[.]com
- nationalstrategyadvisorshq[.]com
- nationalstrategygrouphq[.]com
- pensionadvisoryconsultantshq[.]com
- pensionadvisorystrategieshq[.]com
- pensionbrains[.]com
- pensionconsultinggroupconsultants[.]com
- pensionconsultinggrouphq[.]com
- pensioncorpservices[.]org
- pensioncorpserviceshq[.]com
- pensioncounselors[.]com
- pensiondirectors[.]org
- pensiondivision[.]org
- pensionexpertsgroup[.]org
- pensionfocusgrouphq[.]com
- pensionfocusnetwork[.]com
- pensioninitiators[.]com
- pensionmanagementconsultantsgroup[.]com
- pensionplanningnetworkhq[.]com
- pensionplanningstrategieshq[.]com
- pensionretirementgrouphq[.]com
- retirementconsultingadvisorshq[.]com
- retirementstrategistsgrouphq[.]com
- retirementsupportplangroup[.]com
- teamemployeebenefits[.]com
- teampublicemployeebenefits[.]com
- totalbenefitpros[.]com
- yourstrategiesadvisor[.]com
Edit (Feb 17, 2026): We now attribute this campaign to a threat actor we track as BLUELYNX.