My CalNet account was recently unlocked. What do I do next?

A knowledge base article about My CalNet account was recently unlocked. What do I do next? provided by the UC Berkeley IT Service Hub - Knowledge Portal

Securing Your CalNet Account After Unlock

Now that your CalNet account at UC Berkeley has been unlocked, you must reset your passphrase and complete a security audit of your personal data to ensure no unauthorized changes were made while your account was exposed.

Step 1: Reset Your Passphrase

  1. Go to mycalnet.berkeley.edu.
  2. Select "Forgot my CalNet ID / Passphrase".
  3. Enter your Student, Employee, or Affiliate ID NUMBER, or your recovery email address.
  4. Complete the CAPTCHA verification (confirm you are not a robot by selecting the applicable images).
  5. Once you receive the reset email, follow the link and enter your ID number again to set a new, strong passphrase.

Step 2: Security Checklist

An exposed CalNet passphrase puts your personal data at risk. You must complete each of the following tasks immediately after resetting your passphrase.

1. Verify Direct Deposit (Employees Only)

From a safe and malware-free computer, log in to UCPath and confirm that no changes have been made to your Direct Deposit account. If you cannot log in, call Payroll immediately at 510-642-1336.

2. Check bMail Forwarding and Filters

Confirm that your email is not being redirected to an unknown account and that no unauthorized filters have been created (e.g., a filter that sends bank emails directly to the Trash).

3. Review Activity Logs and Sign Out of Sessions

  1. Log into your bMail account.
  2. In the lower-right corner, under "Last account activity," click the Details link.
  3. Review the list for any unknown IP addresses or locations.
  4. Click the button to "Sign out of all other web sessions."

4. Secure Your Recovery Email

Change the password for your Recovery Email Address (the non-Berkeley address attached to your CalNet account). This ensures that if the attacker gained access to your secondary email, they can no longer use it to reset your CalNet credentials.

5. Recreate Your bConnected Google Key

If you had a Google key set for mobile or desktop mail clients, it has been scrambled for your protection. Create a new one using the Manage My Keys application. For assistance, contact bConnected support at 510-664-9000 (press 1) or email bconnected@berkeley.edu.

6. Audit CalNet 2-Step Devices

Log in to mycalnet.berkeley.edu, select Manage 2-Step Verification, and review your enrolled devices. Ensure no unknown devices have been added. For guidance, see the How to Use CalNet 2-Step (KB0015541) guide.