IT systems at the University of Texas (UT) San Antonio have been taken offline following a cyber incident, causing significant disruption to student registrations and payments ahead of the start of term this week.
A statement released by university leaders on August 17 revealed that the institution had identified “attempted unauthorized activity” at the edge of its network, before reaching core systems.
At this point, University Technology Solutions (UTS) took action with expert partners to contain the activity, resulting in some systems being taken offline so a thorough evaluation of the environment can take place and to assess whether additional protections need to be implemented.
UT San Antonio claimed its response has been effective. So far, there has been no evidence that data was accessed or exfiltrated as a result of the unauthorized activity.
The institution acknowledged that the shut down of IT systems is causing disruption for its community ahead of the start of term on August 19.
“With classes beginning this Wednesday, we recognize how important, reliable access to university systems and services is for our students, faculty and staff. Our teams are working with great care to ensure that our technology environment is both available and secure as we begin the new academic year,” the statement read.
These disruptions have impacted online registration and tuition payments. Extensions have been granted for students to complete these processes.
University phone systems were not available according to a 12.30pm CST update on August 17, but were expected to be restored later that day.
An update on the University’s Facebook page at 5.30pm CST on August 17 said that students, faculty and staff would be sent instructions to reset their passphrases on Tuesday, August 18.
Education a Major Target at Start of Term
Educational institutions, including schools, colleges and universities, have been heavily targeted by cyber-attacks at the start of the new academic year over recent years.
This is likely because IT systems are under extra pressure at these times, with activities such as registering for classes, paying tuition and accessing course information taking place.
Ross Filipek, CISO at Corsica Technologies, commented, “Taking major systems offline at that moment creates immediate pressure to get everything running again. Whether that timing was intentional isn’t clear. Still, attackers understand that disruption carries more weight when an organization is already operating at maximum capacity. Universities are no different from hospitals or retailers in that respect. The more painful downtime becomes, the more leverage an attacker potentially gains.”
Read now: Ransomware Attacks Targeting Universities on the Rise
Filipek praised UT San Antonio for detecting and containing the incident early but highlighted the importance of segmentation to prevent wider systems being affected by these measures.
“Cyber resilience means being able to contain a threat without forcing the rest of the organization to choose between security and keeping the doors open,” he added.
Image credit: JHVE / Shutterstock.com
