The provincial privacy watchdog is looking into a cyberattack at the University of Guelph earlier this month that impacted shared storage systems as well as debit and credit card systems, a spokesperson confirmed.
“Cyberattacks have become an increasingly dangerous threat to the security of personal information and electronic records,” said the Information and Privacy Commissioner (IPC) of Ontario spokesperson in an email. “Public institutions in Ontario, including universities, are required by law to take reasonable measures to ensure that personal information in their custody and control is secure and protected against unauthorized access, and inadvertent destruction or damage.”
The U of G has declined interview requests on the matter and pointed inquiries to a brief statement it posted on its web site.
A cyberattack on the school’s systems happened Sept. 11. It resulted in a variety of electronic services either going down or being shut down by university officials in response to the attack.
University officials notified the IPC of the breach on Sept 19, the spokesperson noted, adding, “Given that our review is currently in progress, we are unable to share any further details at this time.”
The IPC only gets involved in matters that involve personal information.
Among the services impacted were VPN access to university systems, Eduroam, services hosted in the university data centre, shared file storage/CFS file shares, printing at the campus library, and editing capabilities for Drupal and WordPress websites hosted by CCS.
Debit and credit systems, as well as the parking permit systems also went down but were restored within a couple days.
Staff and students were urged to change their login passwords.
The most recent update on the university’s website, posted Sept. 22, states computing and communications services “continues to investigate and resolve an incident that is impacting” systems, with work continuing to “restore full functionality to IT systems.”
Asked about the status of that work now, Kimberly Moser, the university’s news service manager, said, “There are no additional updates at this time.”
There’s no set date for releasing new details, she noted in a follow-up email.
“It’s just when/if there’s new information to share.”
