Data purporting to belong to the University of the West of Scotland (UWS) has been put up for auction by a group of cybercriminals in an attempt to extort money. The university acknowledged that it had experienced some problems with its system earlier this month – which it described as “ cyber”.
See also: Manchester University: Hackers threaten data leak
The ransomware gang, called Rhysida, is demanding 20 bitcoins (£450,000) for the confidential data and is threatening to sell it to the highest bidder if the ransom. Police were first notified of the incident on July 6. At the time, the university's website was down and an error message was displayed apologizing for the disruption.
Initially, no criminal group claimed responsibility. However, Rhysida is now claiming responsibility for the incident and appears to have attempted to blackmail the university using the stolen data.
The information advertised on the gang's registered site on the deep web includes personal data such as banking information, national insurance numbers and internal university documents. The group's list, according to the BBC, is real, but the authenticity of the data has not been verified.
“These criminal gangs operate for profit and reputation. Surprisingly, it doesn't serve them to forge stolen data.“
Brett Callow, a threat analyst at cybersecurity firm Emisoft, said the group likely hopes the university will pay the amount.
See also: Ransomware attack continues at Bluefield University
The Rhysida ransomware group was first detected in May of this year, according to cybersecurity website Sentinel One. It has launched attacks on multiple organizations worldwide.
Sentinel One reports that the group has been classified as a “cybersecurity group” that provides assistance to its victims, attacks their systems, and highlights weaknesses in their online security.
The University of the West of Scotland (UWS) has campuses in Paisley, Ayr, Dumfries and Blantyre, as well as London. At the time of the incident, a UWS spokesperson told BBC Scotland that the university was working with the police, the National Cyber Security Centre and the Scottish Government to resolve the issue.
The National Cyber Security Center's website states that it does not encourage, endorse, or support the payment of ransoms.
A police spokesman said: “An investigation is underway following a report of a cyber incident in Paisley. The matter was reported to police on July 3, 2023 and enquiries are ongoing.”
Last month, the University of Manchester was hit by a similar cyberattack, while several organizations, including the BBC, paid the price for the massive hack.
See also: Open University of Cyprus: Victim of Medusa ransomware?
Often, ransomware is installed on systems without the user's knowledge, through seemingly harmless applications or links. Regardless of the size or type of organization, it is essential to take measures to protect against cyberattacks, including ransomware attacks, by constantly updating security systems and educating users about cyberthreats.
