University of the Highlands and Islands shuts down campuses as it deals with ‘ongoing cyber incident’ • The Register
The University of the Highlands and Islands (UHI) in Scotland is fending off “an ongoing cyber incident” that has shut down its campuses.
In a message to students and staff yesterday afternoon, the institution, which spans 13 locations across the northernmost part of the UK, warned that “most services” – including its Brightspace virtual learning environment – were affected.
“We are currently working to isolate and minimise impact from this incident with assistance from external partners. We do not believe personal data has been affected,” said the university, adding: “The source of the incident is not yet known.”
An email sent to students and published on UHI’s website said that its Office 365, Cisco Webex, OneDrive, Teams, and email services, among others, were not affected by the apparent intrusion. Administrators reiterated they didn’t believe personal data had been affected.
Insurance firm Ardonagh Group disabled 200 admin accounts as ransomware infection took hold
Ransomware is malware that encrypts everything in its path and leaves a ransom note for the victims to read. The criminals behind it typically demand a large payoff in Bitcoin or similar cryptocurrency in return for the decryptor to unlock the victim’s files. An increasingly popular variation on this theme is for the crims to also copy sensitive files from the victim’s network and demand a second ransom to prevent their publication.
Regular readers will recognise UHI’s wording as having lots in common with the early stages of previous ransomware attacks: unattributed “cyber incidents” that mysteriously knock out large swathes of IT services across an organisation are the usual tell-tale. Such incidents have happened to insurance companies, charities and other corporate (and educational) bodies with increasing frequency over the last year.
UHI had not responded to The Register‘s emailed enquiries by the time of publication. Some of its campuses were still due to be opened today, as detailed on its website.
Best practice in case of a ransomware attack is not to engage with the attackers’ demands for money, though desperate organisations have increasingly begun turning to cyber insurance companies whose policies may buy off the criminals and clear the infection. ®
