⚠ Physical danger or immediate emergency? Call 911 first. Contact the Pitt Digital Help Desk after you are safe.
Report a Security Incident All incident reports go through the Pitt Digital IT Services portal. Submitting a ticket ensures your report reaches the right team and is tracked to resolution, 24 hours a day. Submit a Ticket Now → Prefer to call? 24/7 Help Desk: 412-624-HELP (4357)
What Is a Security Incident?
A security incident is any attempted or actual unauthorized access, use, disclosure, modification, or destruction of University information — or interference with University technology operations. You do not need to be certain an incident has occurred. When in doubt, report it. Our team investigates every report.
| › Compromised Pitt account or stolen password |
› Malware, ransomware, or virus on a device |
| › Phishing email or fake Pitt login page |
› Unauthorized access to University systems or data |
| › Unexpected Duo push you did not initiate |
› Lost or stolen device containing University data |
| › Possible exposure of sensitive or restricted data |
› Suspicious software or unexpected remote access |
What to Include in Your Report
Include as much of the following as you know. You can always add more detail after submitting.
| ✓ Your name, department, and Pitt email address |
✓ Your phone number (so we can reach you quickly) |
| ✓ Description of what happened or what you noticed |
✓ Date and approximate time you first noticed the problem |
| ✓ Affected device name or computer name, if known |
✓ Any error messages or unusual behavior you observed |
| ✓ Whether sensitive or restricted data may be involved |
✓ Other accounts, users, or systems that may be affected |
How to Report
All security incidents are reported through the Technology Help Desk. Choose the method that is fastest and most accessible to you.
1. Submit a Help Desk ticket (preferred)
Use the TDX Security Incident Request form to submit a detailed report any time, 24/7.
2. Call the Technology Help Desk
For urgent situations, call 412-624-HELP (4357) immediately. Available 24/7.
3. Report phishing using the KnowBe4 Phish Alert Button (PAB)
For suspicious emails you have not yet clicked or responded to, the KnowBe4 PAB is the preferred method. One click reports the email to Pitt Digital, removes it from your inbox, and preserves the metadata needed for investigation.
Phish Alert Button (PAB) — Preferred for unclicked phishing emails. Look for it in your Outlook ribbon or toolbar.
› Reporting Phishing Emails Using KnowBe4’s Hybrid Phish Alert Button
› Phishing Emails: Don’t Take the “Bait”
How to Report Specific Types of Incidents
All incidents are reported through the same ticketing portal. The steps you take before and while reporting vary by type. Choose the situation that best matches yours.
📧 Phishing email or suspicious login request High Priority
If you received a suspicious email, approved a Duo push you did not initiate, or may have entered your Pitt password on a fake website, act immediately. Every minute matters.
- 1Do not approve any pending Duo push. A push you did not initiate means someone else has your password. Deny it and do not approve under any circumstances.
- 2Change your Pitt password immediately from a trusted device at my.pitt.edu.
- 3Use the KnowBe4 Phish Alert Button (PAB) or the Report button in Outlook to report the suspicious email.
- 4Submit a ticket to Pitt Digital so our team can review for signs of account compromise and session hijacking.
- 5Change passwords on any other accounts where you reused the same password.
Remember: Pitt Digital will never ask for your password via email or phone. Legitimate Duo prompts only appear when you are actively logging in yourself.
🔑 Compromised Pitt account or unauthorized sign-in Urgent
If someone has gained unauthorized access to your Pitt account, email, or OneDrive, act immediately to limit what the attacker can access.
- 1Change your Pitt password immediately at my.pitt.edu from a device you trust.
- 2Submit a ticket to Pitt Digital immediately. Our team will review sign-in logs and revoke active sessions.
- 3Review your Outlook inbox rules and email forwarding settings for unauthorized changes.
- 4Check your Duo-enrolled devices at passport.pitt.edu and remove any devices you do not recognize.
- 5Change passwords on any other accounts where you used the same password.
If your account is disabled as part of a security response, call the Pitt Digital 24/7 Help Desk at 412-624-HELP (4357) to recover access from a clean device.
🖥 Malware, ransomware, or virus on your device Urgent
If your computer is showing ransom messages, behaving strangely, or you suspect a malware infection, isolate the device before doing anything else.
- 1Do not power off the machine. Shutting it down can destroy forensic evidence and, with some ransomware, trigger further encryption.
- 2Disconnect from the network by unplugging the network cable or disabling Wi-Fi. Do not disconnect USB drives yet.
- 3Submit a ticket and call 412-624-HELP immediately. Describe the symptoms and the device name or computer name.
- 4Do not attempt to remove the malware yourself or delete suspicious files. Leave the device as-is for forensic analysis.
- 5From a separate, clean device, change your Pitt password and any other passwords you used on the infected machine.
Do not attempt self-remediation. Deleting files, running removal tools, or reinstalling the OS before our team can examine the device may destroy evidence needed for a thorough investigation.
💻 Lost or stolen device containing University data High Priority
If a laptop, phone, tablet, or USB drive containing University data is lost or stolen, report it regardless of whether you think the device was encrypted. If the device was stolen, report to Pitt Police before contacting the Help Desk.
- 1If the device was stolen, report it to Pitt Police first. Call 412-624-2121. You can also report in person at the Jerome Cochran Public Safety Building, 3412 Forbes Avenue. See all reporting options. If the device was simply lost (not stolen), skip to step 2.
- 2Submit a ticket to Pitt Digital. If you filed a police report, include the case number and the name of the officer assigned to the case in your ticket. This information is required for Pitt Digital to coordinate with Pitt Police on the response.
- 3From a separate, trusted device, change your Pitt password and revoke any active sessions at my.pitt.edu.
- 4Note what University data was on the device so Pitt Digital can assess the potential exposure. Consult the Data Risk Classification Standard if you are unsure what counts as sensitive data.
Pitt Police — 412-624-2121 | police@pitt.edu | Report a Crime
📄 Possible exposure of sensitive or restricted data Urgent
If you believe Restricted or Private University data may have been accessed or disclosed without authorization, report it immediately. This includes Social Security numbers, protected health information, student records, financial data, and controlled research data.
- 1Report immediately by submitting a ticket and calling 412-624-HELP. Do not wait to investigate on your own.
- 2Document what data was potentially exposed, approximately how many records, and how the exposure may have occurred.
- 3Do not notify affected individuals or issue any public statements before coordinating with Pitt Digital and the Office of General Counsel. Premature notification can complicate the regulatory response.
- 4Preserve all logs, emails, and system information. Do not delete anything related to the incident.
- 5If AI or GenAI tools were involved, note which tool and confirm whether it is approved for the data classification level of the exposed data.
Regulatory obligations may apply. Breaches involving health information (HIPAA), student records (FERPA), or financial data may require mandatory notification. Pitt Digital will coordinate the legal and regulatory response.
⚠ Something seems off — not sure if it is an incident Standard
If something unusual caught your attention but you are not sure whether it rises to the level of a security incident, submit a ticket and let our team evaluate it. Common examples include unfamiliar programs installed on your device, unexpected password-reset emails you did not request, unusual account activity you cannot explain, or someone accessing your shared drive without an obvious reason.
- 1Do not delete, uninstall, or modify the suspicious item before reporting. Our team needs to examine it as you found it.
- 2Submit a ticket describing what you observed, when you noticed it, and on which device or account.
- 3If the concern involves unauthorized software on a University-managed device, also notify your departmental IT.
When in doubt, report it. It is far better to report a false alarm than to miss a genuine threat. Pitt Digital will investigate and advise you on next steps.
📄 Know your data classifications
Whether an incident requires immediate escalation depends in part on what type of data is involved. The University classifies data as Restricted (highest risk — Social Security numbers, health information), Private (moderate risk — student records, personnel files), or Public (low risk). When in doubt, treat the data as Restricted and report immediately. University-approved AI tools are also subject to data classification requirements — not all data may be entered into AI tools, even approved ones.
Data Risk Classification Standard Approved AI Tools and Data Classifications
Protect Yourself: Security Best Practices
Pitt Digital has observed a surge in targeted spear phishing attacks incorporating the names of University personnel and arriving from non-Pitt addresses. The following steps significantly reduce your risk.
1. Only approve Duo requests you initiated
An unexpected Duo push means someone else has your password. Deny the push and change your Pitt password immediately. |
2. Use a unique password for every account
Create a distinct password for Pitt Passport and different ones for all other accounts. A password manager makes this practical. |
3. Know how to spot phishing
Watch for urgency, typos, requests from non-Pitt addresses, or prompts to reply using personal email. Use the KnowBe4 PAB or Report button in Outlook. |
4. Keep software and browsers updated
Enable auto-updates on your browsers and operating system. University-managed devices receive security updates automatically. |
5. Complete required security training
Annual cybersecurity training is required for all faculty and staff. Search “security training” on myPitt to complete it, powered by KnowBe4. |
6. Only install apps from trusted sources
For University work, any application must undergo a vendor security risk assessment before installation. Contact Pitt Digital if you are unsure. |
When in doubt, report it.
You do not need to be certain a security incident has occurred to submit a ticket. Our team investigates every report and will tell you quickly whether action is needed.
Submit a Ticket →
24/7 Help Desk: 412-624-HELP (4357)