{"id":182,"date":"2025-12-01T20:12:00","date_gmt":"2025-12-01T20:12:00","guid":{"rendered":"http:\/\/localhost\/?p=29"},"modified":"2025-12-01T20:12:00","modified_gmt":"2025-12-01T20:12:00","slug":"employee-benefit-advisor-contact","status":"publish","type":"post","link":"https:\/\/securityblog.denison.edu\/index.php\/2025\/12\/01\/employee-benefit-advisor-contact\/","title":{"rendered":"Employee benefit advisor contact"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Denison&#8217;s cybersecurity intelligence has been made aware of a financial scam targeting faculty, administrative staff, and support operating staff. If you receive a suspicious message, please forward it to <a href=\"mailto:isitsafe@denison.edu\">isitsafe@denison.edu<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is the message trying to steal?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The message attempts to steal sensitive personal information, including social security numbers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What do I do if I get a malicious message?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not click links, call phone numbers, or reply to the message.<\/li>\n\n\n\n<li>Do not give your personal information.<\/li>\n\n\n\n<li>Report the message to <em>Is It Safe<\/em> by forwarding it to <a href=\"mailto:isitsafe@denison.edu\">isitsafe@denison.edu<\/a>.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How can I tell the message is malicious?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Denison&#8217;s ONLY partners for employee assistance are ComPsych (through the Employee Assistance Program, or EAP) and TIAA. You may receive legitimate communications from TIAA about your retirement accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you aren&#8217;t sure whether a message is malicious or not, forward it to <a href=\"mailto:isitsafe@denison.edu\">isitsafe@denison.edu<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The message subject might contain a claim about being a retirement planner, asking you to set up a meeting with them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some example subject lines include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Interested in setting up your plan review<\/li>\n\n\n\n<li>Would you like to set up your pension appointment?<\/li>\n\n\n\n<li>Still options to book your retirement check-in<\/li>\n\n\n\n<li>Options remain to book your savings appointment<\/li>\n\n\n\n<li>Closing out \u2013 book your plan review<\/li>\n\n\n\n<li>Reminder to book your plan check-in<\/li>\n\n\n\n<li>Last chance to set up your plan session<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We have observed the suspicious email originating from many domains, including:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can limit who can add events to your Google Calendar.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>addpensionmax[.]com<\/li>\n\n\n\n<li>addpensionzone[.]com<\/li>\n\n\n\n<li>advantahealthcore[.]com<\/li>\n\n\n\n<li>benefitadvisorystrategieshq[.]com<\/li>\n\n\n\n<li>benefitconsultantsplatformhq[.]com<\/li>\n\n\n\n<li>benefitconsultantsstrategists[.]com<\/li>\n\n\n\n<li>benefitconsultgrouphq[.]com<\/li>\n\n\n\n<li>benefitconsultinggrouphq[.]com<\/li>\n\n\n\n<li>benefitconsultpartnershq[.]com<\/li>\n\n\n\n<li>benefitexpertsstrategieshq[.]com<\/li>\n\n\n\n<li>benefitmanagementadvisorshq[.]com<\/li>\n\n\n\n<li>benefitmanagersstrategieshq[.]com<\/li>\n\n\n\n<li>benefitmgmtteamhubhq[.]com<\/li>\n\n\n\n<li>benefitprimeglobal[.]com<\/li>\n\n\n\n<li>benefitsconsultantshub[.]com<\/li>\n\n\n\n<li>benefitsconsultingfirm[.]com<\/li>\n\n\n\n<li>benefitsconsultinggrouphq[.]com<\/li>\n\n\n\n<li>benefitsconsultingteamhq[.]com<\/li>\n\n\n\n<li>benefitsreviewexperts[.]com <\/li>\n\n\n\n<li>benefitsstrategyhub[.]com<\/li>\n\n\n\n<li>benefitstrategicgroup[.]org<\/li>\n\n\n\n<li>benefitvisionnetwork[.]com<\/li>\n\n\n\n<li>consultingemployeebenefits[.]com<\/li>\n\n\n\n<li>ebgbenefitsteamhq[.]com<\/li>\n\n\n\n<li>ebgconnectconsultants[.]com<\/li>\n\n\n\n<li>ebgconnectgroup[.]com<\/li>\n\n\n\n<li>ebgconnecthub[.]com<\/li>\n\n\n\n<li>ebgconnecthubhq[.]com<\/li>\n\n\n\n<li>ebgconnecthubsolutions[.]com<\/li>\n\n\n\n<li>ebgconnectservices[.]com<\/li>\n\n\n\n<li>ebgconsultinghub[.]com<\/li>\n\n\n\n<li>ebgproshub[.]com<\/li>\n\n\n\n<li>ebgstrategyhq[.]com<\/li>\n\n\n\n<li>ebgworldstrategies[.]com<\/li>\n\n\n\n<li>empbenefitzone[.]com<\/li>\n\n\n\n<li>employeebenefitconsultinghq[.]com<\/li>\n\n\n\n<li>employeebenefitleaders[.]com<\/li>\n\n\n\n<li>employeebenefitnetworking[.]com<\/li>\n\n\n\n<li>employeebenefitsbizhq[.]com<\/li>\n\n\n\n<li>employeebenefitsconsulthq[.]com<\/li>\n\n\n\n<li>employeebenefitsgroup[.]net<\/li>\n\n\n\n<li>employeebenefitshubhq[.]com<\/li>\n\n\n\n<li>employeebenefitsmanagementgrouphq[.]com<\/li>\n\n\n\n<li>employeebenefitsolutionshub[.]com<\/li>\n\n\n\n<li>employeebenefitsolutionshubhq[.]com<\/li>\n\n\n\n<li>employeebenefitspartnershq[.]com<\/li>\n\n\n\n<li>employeebenefitsplanconsultantsgroup[.]com<\/li>\n\n\n\n<li>employeebenefitsplanninghq[.]com<\/li>\n\n\n\n<li>employeebenefitsreportshq[.]com<\/li>\n\n\n\n<li>employeebenefitsreviewshq[.]com<\/li>\n\n\n\n<li>employeebenefitssolutionsnetwork[.]com<\/li>\n\n\n\n<li>employeebenefitsteamhq[.]com<\/li>\n\n\n\n<li>employeebenefitstrategisthq[.]com<\/li>\n\n\n\n<li>employeebenefitsupportservices[.]com<\/li>\n\n\n\n<li>employeeplanexpertshq[.]com<\/li>\n\n\n\n<li>forthrightcps[.]com<\/li>\n\n\n\n<li>getbenefitscounsulting[.]com<\/li>\n\n\n\n<li>getstrategistcore[.]com<\/li>\n\n\n\n<li>getstrategistlink[.]com<\/li>\n\n\n\n<li>getstrategistplex[.]com<\/li>\n\n\n\n<li>getstrategistzone[.]com<\/li>\n\n\n\n<li>getworkbenefits[.]com<\/li>\n\n\n\n<li>gonetworkconsultant[.]com<\/li>\n\n\n\n<li>insightpensiongroup[.]com<\/li>\n\n\n\n<li>legacyretirementconsulting[.]com<\/li>\n\n\n\n<li>nationalconsultingstrategists[.]com<\/li>\n\n\n\n<li>nationalpensionstrategygroup[.]com<\/li>\n\n\n\n<li>nationalretirecore[.]com<\/li>\n\n\n\n<li>nationalstrategistsplanhq[.]com<\/li>\n\n\n\n<li>nationalstrategyadvisorshq[.]com<\/li>\n\n\n\n<li>nationalstrategygrouphq[.]com<\/li>\n\n\n\n<li>pensionadvisoryconsultantshq[.]com<\/li>\n\n\n\n<li>pensionadvisorystrategieshq[.]com<\/li>\n\n\n\n<li>pensionbrains[.]com<\/li>\n\n\n\n<li>pensionconsultinggroupconsultants[.]com<\/li>\n\n\n\n<li>pensionconsultinggrouphq[.]com<\/li>\n\n\n\n<li>pensioncorpservices[.]org<\/li>\n\n\n\n<li>pensioncorpserviceshq[.]com<\/li>\n\n\n\n<li>pensioncounselors[.]com<\/li>\n\n\n\n<li>pensiondirectors[.]org<\/li>\n\n\n\n<li>pensiondivision[.]org<\/li>\n\n\n\n<li>pensionexpertsgroup[.]org<\/li>\n\n\n\n<li>pensionfocusgrouphq[.]com<\/li>\n\n\n\n<li>pensionfocusnetwork[.]com<\/li>\n\n\n\n<li>pensioninitiators[.]com<\/li>\n\n\n\n<li>pensionmanagementconsultantsgroup[.]com<\/li>\n\n\n\n<li>pensionplanningnetworkhq[.]com<\/li>\n\n\n\n<li>pensionplanningstrategieshq[.]com<\/li>\n\n\n\n<li>pensionretirementgrouphq[.]com<\/li>\n\n\n\n<li>retirementconsultingadvisorshq[.]com<\/li>\n\n\n\n<li>retirementstrategistsgrouphq[.]com<\/li>\n\n\n\n<li>retirementsupportplangroup[.]com<\/li>\n\n\n\n<li>teamemployeebenefits[.]com<\/li>\n\n\n\n<li>teampublicemployeebenefits[.]com<\/li>\n\n\n\n<li>totalbenefitpros[.]com<\/li>\n\n\n\n<li>yourstrategiesadvisor[.]com<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Edit (Feb 17, 2026): We now attribute this campaign to a threat actor we track as <\/em>BLUELYNX.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Denison&#8217;s cybersecurity intelligence has been made aware of a financial scam targeting faculty, administrative staff, and support operating staff. If you receive a suspicious message, please forward it to isitsafe@denison.edu. What is the message trying to steal? The message attempts to steal sensitive personal information, including social security numbers. What do I do if I get a malicious message? How can I tell the message is malicious? Denison&#8217;s ONLY partners&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-182","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/posts\/182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/comments?post=182"}],"version-history":[{"count":0,"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/posts\/182\/revisions"}],"wp:attachment":[{"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/media?parent=182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/categories?post=182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securityblog.denison.edu\/index.php\/wp-json\/wp\/v2\/tags?post=182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}