A colleague opens their PARTAGE inbox on Monday morning and discovers three password reset emails that they never requested. This seemingly mundane scenario often signals an attempted fraudulent access.
At the Nancy-Metz academy, the academic email remains the main gateway to professional applications. Each compromised account can serve as a springboard to other services (ONDE, LSU, ENT). Strengthening the security of this email system does not require a grand technical plan, but rather concrete reflexes to embed in daily routine.
Redirects to a personal inbox: a transfer to audit as a priority
Many teachers and administrative staff redirect their academic emails to a personal Gmail or Outlook address to centralize their messages. This practice seems harmless. However, it exposes professional exchanges to an environment over which the academy has no control over encryption, storage conditions, or GDPR compliance.
Union documents have explicitly pointed out the end of academic email redirects to private addresses as a data protection issue. On PARTAGE, this setting can be checked in just a few clicks: Preferences menu, then Mail tab, Message Reception section. If an automatic transfer is active to an external address, disabling it removes a silent leakage vector.
For those wishing to delve deeper into best practices for securing the PIAL email of Nancy-Metz, the issue of redirects is the first item to audit even before addressing passwords.
Academic password and ENT: why reuse multiplies breaches
In 2024, identity theft affected digital workspaces of schools in the Nancy-Metz academy. The intrusions were based on the recovery of student and teacher credentials, often obtained through phishing or by reusing the same password across multiple services.
The problem is structural. When the PARTAGE password is the same as that used on a forum, an online store, or a social network, the compromise of just one of these services grants access to professional email. A unique password per service prevents the spread of a leak.
Building a strong password without a manager
Not everyone has a password manager on their workstation. A simple method is to start with a personal phrase that is easy to remember, then extract the initials while injecting numbers and special characters. For example, “My office is on the 3rd floor since September” can yield “Mois3fss!”. The academy generally imposes a minimum length, but aiming for more than ten characters is preferable.
- Never reuse the academic password on a personal service (social networks, e-commerce, forums).
- Change the password immediately after any alert of suspicious login or unsolicited reset email.
- Check the recent login history in PARTAGE if the feature is available, to spot access from an unusual location.
Targeted phishing in the Nancy-Metz academy: recognizing concrete signals
Phishing emails sent to national education staff no longer resemble the crude scams of a few years ago. They use institutional vocabulary (DSDEN, NUMEN, intra-academic movement) and mimic the layout of official academy messages.
Systematically check the complete sending address is the most reliable reflex. An email appearing to come from the rectorate but whose domain after the “@” does not end with “ac-nancy-metz.fr” is suspicious. Hovering over the link without clicking allows you to read the destination URL in the browser or email client’s status bar.
What to do when faced with a suspicious message
Do not click, do not reply, do not forward to colleagues “to verify.” The right reflex: report the message via the internal procedure of the institution or contact the digital referent of the district directly. On PARTAGE, it is possible to mark the message as spam, which feeds the filters for all users of the academy.
Responses vary on this point, but several institutions in Moselle have set up a dedicated channel (often a discussion group or a functional address) to centralize reports and quickly disseminate alerts to the entire team.
Email filters and sorting rules: an overlooked attack surface
Automatic sorting rules in PARTAGE can be exploited by an attacker who briefly accessed the account. A malicious rule can silently redirect or delete certain messages, for example those containing the words “password,” “security,” or “alert,” rendering the victim blind to compromise notifications.
After any password change or suspicion of unauthorized access, review the active filters in Preferences, then Filters. Any unknown or unintentionally created rule should be deleted immediately. This check takes less than a minute and can prevent weeks of silent monitoring by a third party.
- Check sorting and forwarding filters after every security incident, even minor ones.
- Remove obsolete rules that redirect emails to old accounts or addresses of colleagues who have changed positions.
- Document active rules in a shared file with the management team to facilitate auditing in case of issues.
PARTAGE connection security: shared workstations as a weak link
In many schools, the same computer is used by multiple staff members. The PARTAGE session sometimes remains open after a user leaves. Logging out systematically after each use is not a theoretical recommendation; it is the only safeguard on a non-personal workstation.
Using private browsing to access PARTAGE on a shared workstation prevents the browser from storing cookies and credentials. This forces authentication at each session, reducing the risk that a colleague or student inadvertently accesses someone else’s inbox.
The Nancy-Metz academy provides a centralized authentication portal via id.ac-nancy-metz.fr. Always go through this official URL, rather than an old favorite or a link received by email, to protect against fake login pages.
Each of these actions takes less than a minute: check your filters, disable external redirects, never recycle a password, report suspicious emails without forwarding, log out on a shared workstation. Their regularity protects the account far more than a one-time audit.