<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",serif;
color:#1F497D;}
span.shorttext
{mso-style-name:short_text;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="SV" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US">At Chalmers University of Technology we have been attacked with the same type of phishing mails. They were designed as they
emails Melissa Belvadi describes. We received the mails in the middle of April, and in the beginning of May we were blocked from ACS seven times in a couple of days.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US">In our logs we could see that the breach was affecting several publishers, but they did not block us.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US">The IPs were from many countries for example Canada, China, Japan and Russia.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US">Some other libraries in Sweden were also blocked from ACS several times during the same period, but I don’t know if they received
any phishing mails.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D;mso-fareast-language:EN-US">Best regards,</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">Rose-Marie Boström<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">Bibliotekarie | Librarian<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#464343"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#464343">Biblioteket | The Library<br>
Chalmers tekniska högskola | Chalmers University of Technology<br>
412 96 Göteborg | SE-412 96 Gothenburg, Sweden<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#464343">Tel +46(0)31-772 3706<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#464343">Fax +46(0)31-183544<br>
</span><a href="http://www.lib.chalmers.se/"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif">www.lib.chalmers.se</span></a><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#464343"><br>
E-mail: rose-marie.bostrom@chalmers.se<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#464343"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> Eril-l [mailto:eril-l-bounces@lists.eril-l.org]
<b>On Behalf Of </b>Melissa Belvadi<br>
<b>Sent:</b> den 8 juni 2016 19:09<br>
<b>To:</b> Heather Shipman <heather.shipman@cornell.edu><br>
<b>Cc:</b> eril-l@lists.eril-l.org<br>
<b>Subject:</b> Re: [Eril-l] American Chemical Society blocked IPs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif">Hello, I'm not sure if this is related to the other reports below, but we just experienced a phishing email virus sent to our users, which specifically refers to "library services"
in the subject line and even includes our full name, paper mailing address, and circulation email address in the signature (which appears to be copied right off our homepage footer). The email of course tells the user to click on a link which will then trick
them into giving up their campus username/password. I'm guessing that the intended use of this is to hack the library databases, because of the way the library's identity is targeted in the phishing email. We definitely know of some patrons who have been
tricked already.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif">So I'm expecting some vendor blocking problems to arise in the next day or two.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif">Has anyone else gotten attacked with a similar phishing attack that reference the library in particular, lately?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif">Melissa Belvadi, UPEI<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">On Wed, Jun 8, 2016 at 12:29 PM, Heather Shipman <</span><a href="mailto:heather.shipman@cornell.edu" target="_blank"><span lang="EN-US">heather.shipman@cornell.edu</span></a><span lang="EN-US">> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">If you see the same user appearing in the logs over and over again, it might be worth getting IT to check
their computer for viruses, too. One of our ACS blocks was associated with a single user whose computer had to be referred to Security/IT; it was downloading the same content over and over, and “not honoring” a block from “Network Quarantine”.</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">Heather Shipman</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">E-resources Acquisition Specialist</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">110 Olin Library, Cornell University</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:Heather.shipman@cornell.edu" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#0563C1">Heather.shipman@cornell.edu</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">
; </span><a href="tel:607-254-1499" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">607-254-1499</span></a><span lang="EN-US"><o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> Eril-l [mailto:</span><a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">eril-l-bounces@lists.eril-l.org</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">]
<b>On Behalf Of </b>Sally Krash<br>
<b>Sent:</b> Wednesday, June 08, 2016 8:18 AM<br>
<b>To:</b> </span><a href="mailto:eril-l@lists.eril-l.org" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">eril-l@lists.eril-l.org</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"><br>
<b>Subject:</b> Re: [Eril-l] American Chemical Society blocked IPs</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">They unblocked us Monday afternoon, after we identified the account associated with the unauthorized
use. So, they are working on restoring access to libraries.</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">Sally Krash</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">Head of Information Resources Management</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">W.E.B. Du Bois Library</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D">University of Massachusetts Amherst</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="tel:413-545-6865" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">413-545-6865</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:krash@library.umass.edu" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">krash@library.umass.edu</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif;color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> Eril-l [</span><a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">mailto:eril-l-bounces@lists.eril-l.org</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">]
<b>On Behalf Of </b>Bob Pearson<br>
<b>Sent:</b> Wednesday, 8 June 2016 9:59 a.m.<br>
<b>To:</b> Kathleen Folger <</span><a href="mailto:kfolger@umich.edu" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">kfolger@umich.edu</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">>;
Egan,Noelle <</span><a href="mailto:nme26@drexel.edu" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">nme26@drexel.edu</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">><br>
<b>Cc:</b> </span><a href="mailto:eril-l@lists.eril-l.org" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">eril-l@lists.eril-l.org</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"><br>
<b>Subject:</b> [FORGED] Re: [Eril-l] [FORGED] Re: American Chemical Society blocked IPs</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Yep, into our 3<sup>rd</sup> day of being blocked. Identified a compromised account and
reset the password and notified ACS. They have asked for the IP addresses used, which I will collate and give them, but they have not unblocked us in the meantime. </span><span lang="EN-NZ" style="font-size:10.0pt;font-family:Wingdings;color:#1F497D">L</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Clearly this was a large-scale planned breach. From my first quick look at IPs they seem
to be Russian. I’m curious whether others found the same, or is there a wider geographic spread?</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Bob Pearson<br>
Digital Access Librarian<br>
Digital Services<br>
The University of Auckland Library<br>
New Zealand</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"> Eril-l [</span><a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">mailto:eril-l-bounces@lists.eril-l.org</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">]
<b>On Behalf Of </b>Kathleen Folger<br>
<b>Sent:</b> Wednesday, 8 June 2016 8:37 a.m.<br>
<b>To:</b> Egan,Noelle <</span><a href="mailto:nme26@drexel.edu" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">nme26@drexel.edu</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">><br>
<b>Cc:</b> </span><a href="mailto:eril-l@lists.eril-l.org" target="_blank"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif">eril-l@lists.eril-l.org</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",serif"><br>
<b>Subject:</b> [FORGED] Re: [Eril-l] American Chemical Society blocked IPs</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ">Noelle,</span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ">Thanks so much for sharing this information. We got a report from ACS of a breach via our proxy server and investigated as we do normally. We identified a compromised
user account and reported back to ACS but they have not been responding to our requests to have the block removed. Now I know why.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ">-Kathleen</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"><br clear="all">
</span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ" style="background:white">_________________________________________<br>
Kathleen M. Folger, Electronic Resources Officer<br>
University of Michigan Library<br>
312 Hatcher North<br>
Ann Arbor, MI 48109-1190<br>
V:</span><a href="tel:%28734%29%20764-9375" target="_blank"><span lang="EN-NZ" style="background:white">(734) 764-9375</span></a><span lang="EN-NZ" style="background:white"><br>
F:</span><a href="tel:%28734%29%20764-0259" target="_blank"><span lang="EN-NZ" style="background:white">(734) 764-0259</span></a><span lang="EN-NZ" style="background:white"><br>
</span><a href="mailto:kfolger@umich.edu" target="_blank"><span lang="EN-NZ" style="background:white">kfolger@umich.edu</span></a><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ">On Tue, Jun 7, 2016 at 4:19 PM, Egan,Noelle <</span><a href="mailto:nme26@drexel.edu" target="_blank"><span lang="EN-NZ">nme26@drexel.edu</span></a><span lang="EN-NZ">>
wrote:</span><span lang="EN-US"><o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Here at Drexel we had a hack of 4 users account on Sunday, and the accounts were used to download massive numbers of articles from ACS. ACS subsequently blocked
our access through our EZProxy IP address. <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">I just got off the phone with Richard at ACS about this, who let me know that many universities had user accounts hacked in the same way, and this breach was
affecting several other publishers as well. I was surprised I hadn’t seen any traffic about the issue on this listserv – has anyone else been blocked by ACS or another publisher in the last few days for excessive downloading?
<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">FYI – ACS says they are not unblocking any IP addresses until they have the issue resolved, at which time they’ll email all their affected customers about reinstated
access. <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Thanks, Noelle<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">-------------------------------------------------------------------</span></b><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">Noelle Egan<br>
</span></b><i><span lang="EN-US" style="font-size:10.0pt;color:black">eResources & Acquisitions Librarian</span></i><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:10.0pt;color:black">Drexel University Libraries<i> </i></span><b><i><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span></i></b><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">Drexel University<br>
</span></b><span lang="EN-US" style="font-size:10.0pt;color:black">3300 Market Street<br>
W. W. Hagerty Library<br>
Philadelphia, PA 19104<br>
Tel: </span><a href="tel:215.895.2752" target="_blank"><span lang="EN-US" style="font-size:10.0pt">215.895.2752</span></a><span lang="EN-US" style="font-size:10.0pt;color:black"> | Fax:
</span><a href="tel:215.895.2070" target="_blank"><span lang="EN-US" style="font-size:10.0pt">215.895.2070</span></a><span lang="EN-US" style="font-size:10.0pt;color:black"><br>
</span><a href="http://www.library.drexel.edu/" target="_blank"><span lang="EN-US" style="font-size:10.0pt">drexel.edu/library</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span lang="EN-NZ"><br>
_______________________________________________<br>
Eril-l mailing list<br>
</span><a href="mailto:Eril-l@lists.eril-l.org" target="_blank"><span lang="EN-NZ">Eril-l@lists.eril-l.org</span></a><span lang="EN-NZ"><br>
</span><a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank"><span lang="EN-NZ">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</span></a><span lang="EN-US"><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-NZ"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"><br>
_______________________________________________<br>
Eril-l mailing list<br>
</span><a href="mailto:Eril-l@lists.eril-l.org"><span lang="EN-US">Eril-l@lists.eril-l.org</span></a><span lang="EN-US"><br>
</span><a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank"><span lang="EN-US">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</span></a><span lang="EN-US"><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><br>
<br clear="all">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">-- <o:p></o:p></span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Melissa Belvadi<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Collections Librarian<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">University of Prince Edward Island<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a> 902-566-0581<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>