A USB drive was anonymously mailed to an Eastern Michigan University campus department on Sept. 22, 2025. EMU's Enrollment Management office received the device, said Ron Woody, chief information officer at EMU. The USB drive was not inserted into any campus servers or hardware.
The USB drive contained a written letter, EMU Chief of Police Matthew Lige said. An email sent to the campus community about the incident stated that the messaging in the letter was consistent with propaganda tactics.
The letter used "anonymous type" with recurring themes, including criticism of the European Union and funding for the Russia-Ukraine war, Lige said. The letter encouraged the receiver to insert the USB into a laptop or computer for more information about the Russia-Ukraine war, he added.
"They did not plug the USB drive into any of their computers — they reported it to both IT and campus police because of the suspicious nature of it,” said Rocky Jenkins, director of network and system services in EMU’s information technology department.
“It’s never a good idea to plug in an unexpected USB drive into your computer,” Jenkins added.
The USB drive and letter are undergoing forensic analysis and there is an ongoing investigation, Lige said. There was no source identified or return address included in the letter or USB drive.
The concern with an unknown USB or flash drive is that it could contain a virus that could compromise a computer or laptop and lead to a malware or phishing attack, Lige said.
“We suspect that the USB drive contained programming similar to malware,” Lige said.
There was no attack on any campus server or hardware, and so far, no crime was committed, Lige said.
Police are calling the anonymous USB drive and letter an isolated incident at EMU, with no reports of any other departments or any students receiving a similar USB drive or letter, Lige said. Police are also checking for similar incidents at other higher education institutions as part of the investigation, he added.
Sometimes, students will report unknown thumb drives as lost and found items at the IT help desk, Woody said. In these cases, IT employees will confirm that the student did not plug the drive into any hardware, he added.
"This is the first I remember, at least, that was reported to us, of an office receiving a thumb drive in the mail, or something being delivered to them in this way," Woody said.
Students, staff and faculty should exercise caution if they encounter an unknown or unexpected USB drive, Woody said.
"Don't pick up a drive that you found on the sidewalk and plug it in out of curiosity," Woody said.
If an unexpected USB drive arrives in the mail, even if it is said to be sent from a vendor you already have a relationship with, such as an internet provider, it should not be plugged in, Woody added.
IT staff also reminded students, faculty and staff to be cautious about phishing and malware scams online.
It's wise to exercise caution if you receive an unexpected email, especially one that contains links or attachments, Jenkins said. If a member of the campus community receives an email they suspect is a phishing scam, they should forward the email to phishing@emich.edu, Jenkins said.
If you receive an unsolicited commercial email, you can unsubscribe, block the sender or use Google's option to report spam, Jenkins added.
October is Cybersecurity Awareness Month, Woody said. Staying up to date with current cybersecurity threats is an important way to help prevent them, he added. Woody recommended the National Cybersecurity Alliance's website staysafeonline.org for more resources and information about online safety and privacy.
The following was sent to students, faculty and staff in an email:
What to do if you find or receive a suspicious USB drive:
1. Do not plug it in. Resist any curiosity to see what is on the drive.
2. Do not attempt to identify the owner.
3. Immediately report the device to the EMU Police Department at 734-487-1222.
