UoM students threatened with “data leakage” following cyber attack

Update: The University have since contacted The Mancunion to inform us that they believe ‘a small proportion of data has been copied that relates to some students, and some alumni’. The University has written directly to those individuals who may have been affected by this.

The University has also offered students and staff a free one-year membership, as a precautionary measure, to Experian IdentityWorks service. This service monitors the web, social networks, and public databases to detect theft, loss, or disclosure of personal and financial information.

A cyber incident that occurred on June 6 has compromised private University of Manchester data.

In an email to students, lecturers, administrators, and staff titled “Data leakage!!!” hackers disclosed they have access to seven terabytes of confidential personal information.

This information supposedly includes personal information about students and staff, research data, police reports, drug test results, databases, HR documents, finance documents, and more.

A recent email from hackers warns that anybody who has cheated on exams, been accused of misconduct, or experienced a health incident is at risk.

Contents of the email also describe students as ‘gun “meat”‘ and insinuates lives may be able to be destroyed.

Although The University of Manchester officially advises students and staff to avoid opening emails from hackers, some students are able to access warnings from the hackers through University Email Filtering services.

An email sent today by UoM links to guidance on the University website on how to report these messages to IT services. Likewise, the University advises against responding under any circumstances and has set up a dedicated webpage for guidance and support around the incident.

A correspondence from hackers on June 20 details claimed the administration is “fully aware” of the situation and has been discussing with those behind the cyber incident for over a week. The email also reads:

“They, however, value money above the privacy and security of their students and employees. They do not care about you or that ALL your personal information and research work will soon be sold and/or made public!”

Dame Nancy Rothwell, amongst other senior members of University staff, is named responsible in this email.

The news comes after the University was the target of another cyber attack on June 9.

Staff and students received an email titled “Notification of a cyber incident at The University of Manchester”, informing them the University’s system had been accessed by an “unauthorised party” and data “have likely been copied”.

The University also informed students and staff that “in-house experts and established expert external support are working around the clock to resolve this incident” whilst the University coordinates with the Information Commissioners Office, the National Cyber Security Centre, the National Crime Agency, and other regulatory bodies.

On June 14 the University emailed students requiring them to reset their passwords and removed access to VPN services on all University accounts, stressing that staff and students physically on campus will continue to have access to all systems unless advised otherwise.

The University described this as a ‘critical time’ and has thanked both students and staff for their continued patience.