MRU student, staff data stolen in ransomware cyberattack

The data of students and staff was compromised in a June cyberattack, Mount Royal University officials said Tuesday.

MRU also said the crime was a ransomware attack. The perpetrators typically act as extortionists and demand payment to allow the retrieval of infected data.

Two different targets were affected in the crime first detected June 17, with information in one of them known as the H drive being stolen, said MRU.

"We regret to inform our community that our investigation has now shown that data within certain folders on the University's 'H drive' was accessed and taken by an unauthorized actor," the university said in a statement.

"The actor then deleted our H drive data to impede our recovery."

Data in the drive was used to support students' academic and employees' work. "Depending on what individuals chose to store in the folder, it may contain personal information," the university said.

Only some of the folders in the drive were accessed and MRU said affected individuals will be contacted in the week. Those affected are current and former students and staff, they said.

Also targeted was the university's J drive, containing departmental data, which was deleted by the culprit, although no data was accessed or copied from it, they said.

"We are still working to recover deleted J drive data, but a full recovery may not be possible," said MRU.

The attack disrupted a variety of MRU's systems, including online services, internet access and certain internal systems, said the university.

Analysis of the fallout and the data's recoverability could take weeks or months, they added.

In the meantime, MRU said as a precautionary measure, all current employees and individuals employed within the past five years will be provided with two years of credit monitoring and identity theft protection services.

The Alberta Information and Privacy Commissioner's office is aware of the cyberattack and police have been involved in the investigation, but there have been no arrests.

A week after the attack , one faculty member said the scheduling of courses, fall registration and the payroll system had been most affected, though he said he had been paid.

The instructor also said MRU-issued laptops were recalled to undergo servicing in response to the attack.

A University of Calgary cybersecurity expert lauded MRU for providing theft protection services.

"It shows they're taking it seriously, they're doing the right thing," said Prof. Thomas Keenan.

"My advice is take it, and put all your emails and phone numbers in there."

On Tuesday, the university said the summer semester is unfolding as scheduled and some deadlines for the fall semester have been adjusted.

Its systems, it said, are safe to use and are being brought back online after due diligence and security checks.

There are various levels of concern among students the possibility of their data being compromised, said Liv Lopez, vice-president of student affairs with the Students' Association of MRU.

"It's not monolithic and (the university) has kept the incident quite isolated, though I'm sure they have their reasons," said Lopez.

"There is a lot of uncertainty, and we really do want to encourage anyone concerned with impacts to reach out — we don't take this lightly."

She said students can still add, drop or register for summer courses until July 9, and that returning students can apply for student aid, but new ones cannot.

The crime is among a series of ransomware attacks targeting institutions such as post-secondary schools and health-care providers.

In 2016, the University of Calgary paid $20,000 to culprits in a bid to restore vital research data.

MRU said it's not commenting on the possibility of paying a ransom, focusing instead on "containing the incident, investigating what occurred, and supporting our community."

Universities are particularly vulnerable due to their intake of so many new students who potentially bring computer viruses into the institutions' system, said the U of C's Keenan.

And whatever ransom the institutional victims pay is typically the tip of the iceberg for the cost of the attacks, he said.

"These things can add up to millions of dollars, they hire high-priced help," said Keenan.

One of the costs incurred by the U of C was having to replace computer printers, he added.

[email protected]