Hackers demanded nearly half-million dollars and University of Utah paid up, school says

The University of Utah’s College of Social and Behavioral Sciences was digitally attacked in July, rendering its servers temporarily inaccessible, the university said this week.

The hackers threatened to release sensitive information from the college’s servers if the school didn’t pay up, a crime known as a “ransomware attack,” according to a news release from the university.

The attack occurred on July 19, and 10 days later the university directed students and faculty to change their passwords. Officials determined that about .02% of the servers’ data was affected in the attack.

The university announced Thursday it paid $457,059 to the extortionists to regain access to the stolen data.

“After careful consideration, the university decided to work with its cyber insurance provider to pay a fee to the ransomware attacker,” the university said in a statement. “This was done as a proactive and preventive step to ensure information was not released on the internet.”

The university used funds from its cyber insurance policy as part of the ransom, but covered the rest from the university’s budget. Those funds did not include money from tuition, grants, donations, the state or taxpayers, according to the university.

The data that was accessed contained information on students and employees.

Officials said the school has made “substantial investments” to protect against security breaches.

“Despite these processes, the university still has vulnerabilities because of its decentralized nature and complex computing needs,” the university said. “This incident helped identify a specific weakness in a college, and that vulnerability has been fixed. The university is working to move all college systems with private and restricted data to central services to provide a more secure and protected environment.”

The University of Utah is not alone in its ransomware experience. In early June, hackers used a malware called NetWalker to encrypt the University of California, San Francisco’s medical school data, Government Technology reported.

Nearly 90 universities, colleges and school districts fell prey to ransomware attacks in 2019, according to the website. In the first five months of 2020, 30 attacks have been reported.

Schools aren’t the only targets. North Carolina reported seven ransomware attacks in 2019 at the local and state government levels, The News & Observer reported. More than 20 local governments in Texas were hit by ransomware attacks in Aug. 2019.

“I think, by and large, both state and local entities are being targeted, because [criminals] look at them as low-hanging fruit,” Maria Thompson, the state chief risk officer for the N.C. Department of Information Technology, told The News & Observer last summer.