IT outage at Scotland's Heriot-Watt University enters second week
(2022/03/24)
- Reference: 1648114212
- News link: https://www.theregister.co.uk/2022/03/24/heriot_watt_outage/
- Source link:
Edinburgh's Heriot-Watt University has entered a second week of woe following a vist by an infosec nasty.
The 200-year-old institution's IT team first referred to the crisis as a "security incident" but a spokesperson confirmed to The Register that it was a cyber attack.
A week on, things remain resolutely broken. VPN? Down. Oracle R12 Finance System? Down. Staff shared areas? Down. Even staff and student directories remain unavailable, hinting at some severe trouble within the university's on-premises infrastructure.
[1]
The spokesperson added: "The incident was contained immediately and staff and students alerted to allow them to be supported using alternative systems. We are working closely with Police Scotland and specialist advisers to investigate the cause of the incident which will allow us to further strengthen our future security."
[2]
[3]
They added: "We can confirm that there has been no data leak but while this attack is part of a police investigation we cannot comment further."
Cloudier services such as Teams and email are operating normally, according to the university's [4]status page , as is SharePoint, Oracle ERP, and student and staff portals.
[5]Cybercriminals made $7bn in pure profit in 2021, says FBI
[6]Lockbit wins ransomware speed test, encrypts 25,000 files per minute
[7]Okta now says: Lapsus$ may in fact have accessed customer info
[8]Biden says Russia exploring revenge cyberattacks
Heriot-Watt [9]awarded a £5 million contract to Oracle for its Cloud ERP Software back in 2020.
Judging by emails seen by the The Register , the experience has not been entirely happy, and the dream of efficiencies brought forth by the implementation has yet to be realized and budgets rising.
[10]
A source close to the action told us that the R12 system should have been retired, but was lingering as users got to grips with the new Oracle Fusion platform.
The Register understands that shortly after a payslip whoopsie (in which university staff were apparently warned that historic payslips and P60s would need to be hurriedly printed out since payslips were not part of an impending migration to a new system), large chunks of IT infrastructure at the university fell victim to a cyber attack.
A year ago, the UK's National Cyber Security Centre (NCSC) [11]warned that attacks were on the increase and urged educational institutions to be vigilant. Shortly after, the University of Hertfordshire was forced to pull the plug on its systems after an incident of it own. Other establishments, including Newcastle University, were also the focus of cyber crooks.
[12]
Heriot-Watt is therefore not the first to suffer a cyber attack. However, the timing (while a migration appears to be under way) is unfortunate.
We fear this university won't be the last to suffer an incident of this type. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.hw.ac.uk/uk/services/is/system-status.htm
[5] https://www.theregister.com/2022/03/23/cybercriminals_made_7bn_2021/
[6] https://www.theregister.com/2022/03/23/ransomware_encryption_speed/
[7] https://www.theregister.com/2022/03/23/rere/
[8] https://www.theregister.com/2022/03/22/biden_cybersecurity_statement_warning/
[9] https://bidstats.uk/tenders/2020/W10/722337829
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2021/03/23/ransomware_targeting_education_ncsc_warning/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
The 200-year-old institution's IT team first referred to the crisis as a "security incident" but a spokesperson confirmed to The Register that it was a cyber attack.
A week on, things remain resolutely broken. VPN? Down. Oracle R12 Finance System? Down. Staff shared areas? Down. Even staff and student directories remain unavailable, hinting at some severe trouble within the university's on-premises infrastructure.
[1]
The spokesperson added: "The incident was contained immediately and staff and students alerted to allow them to be supported using alternative systems. We are working closely with Police Scotland and specialist advisers to investigate the cause of the incident which will allow us to further strengthen our future security."
[2]
[3]
They added: "We can confirm that there has been no data leak but while this attack is part of a police investigation we cannot comment further."
Cloudier services such as Teams and email are operating normally, according to the university's [4]status page , as is SharePoint, Oracle ERP, and student and staff portals.
[5]Cybercriminals made $7bn in pure profit in 2021, says FBI
[6]Lockbit wins ransomware speed test, encrypts 25,000 files per minute
[7]Okta now says: Lapsus$ may in fact have accessed customer info
[8]Biden says Russia exploring revenge cyberattacks
Heriot-Watt [9]awarded a £5 million contract to Oracle for its Cloud ERP Software back in 2020.
Judging by emails seen by the The Register , the experience has not been entirely happy, and the dream of efficiencies brought forth by the implementation has yet to be realized and budgets rising.
[10]
A source close to the action told us that the R12 system should have been retired, but was lingering as users got to grips with the new Oracle Fusion platform.
The Register understands that shortly after a payslip whoopsie (in which university staff were apparently warned that historic payslips and P60s would need to be hurriedly printed out since payslips were not part of an impending migration to a new system), large chunks of IT infrastructure at the university fell victim to a cyber attack.
A year ago, the UK's National Cyber Security Centre (NCSC) [11]warned that attacks were on the increase and urged educational institutions to be vigilant. Shortly after, the University of Hertfordshire was forced to pull the plug on its systems after an incident of it own. Other establishments, including Newcastle University, were also the focus of cyber crooks.
[12]
Heriot-Watt is therefore not the first to suffer a cyber attack. However, the timing (while a migration appears to be under way) is unfortunate.
We fear this university won't be the last to suffer an incident of this type. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.hw.ac.uk/uk/services/is/system-status.htm
[5] https://www.theregister.com/2022/03/23/cybercriminals_made_7bn_2021/
[6] https://www.theregister.com/2022/03/23/ransomware_encryption_speed/
[7] https://www.theregister.com/2022/03/23/rere/
[8] https://www.theregister.com/2022/03/22/biden_cybersecurity_statement_warning/
[9] https://bidstats.uk/tenders/2020/W10/722337829
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2021/03/23/ransomware_targeting_education_ncsc_warning/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjxPXeQzVYCUpaLHBsGOkgAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
"hinting at some severe trouble within the university's on-premises infrastructure"
Obviously. It's a university. They don't have the money or the intellectual resources to do things properly.
I know I'm not going to make any friends by saying this, but I've never seen a university network without some major, jaw-dropping choices (and I've seen a few), all because the IT people they have were never top-tier in the first place.
In the second place, an "urgent" ticket is generally considered as something that must be fixed this semester. University IT does not live in the same timeframe as its computers. A cyber attack ? That must have reset their clocks in a very hard fashion.
Maybe some good can come of this. And, if indeed there was no data leaked, well their IT guys do deserve a few brownie points.
Now all they have to do is properly segment their data domains and, the next time, they might be able to not lose everything.
I hope their backups are good.