Mount Royal University ransomware attack compromised student, employee data | #ransomware | #cybercrime

A recent cyberattack that disrupted Mount Royal University’s systems compromised employee and student information in a ransomware attack, the school confirmed Tuesday.

In an update on its investigation, MRU said an unauthorized actor accessed and took folders on its “H drive,” who then deleted the drive’s data. The school’s H drive is a file storage system used by employees and students.

“Our analysis indicates that this incident affected specific folders rather than the entire H drive,” MRU said in a statement on Tuesday. 

“We will begin directly notifying employees and students whose H drive folders were compromised within the coming week.”

MRU provides its H drive to support its staff’s work and students’ academics, which could contain personal information.

The actor also deleted MRU’s “J drive,” which contains corporate data about MRU staff, the school said. But they added it has not found evidence indicating the J drive’s data was accessed or copied before it was deleted.

While the school is working to recover the deleted J drive data, it said a full recovery may not be possible.

The university said it’s not commenting on its discussions with the threat actor, or on if it is paying a ransom.

The cyberattack last month disrupted a range of school services and resources like MRU’s website, its online service MyMRU, on-campus internet access and telephone services.

MRU has said it does not have a timeline for full restoration of its services. A temporary public wireless network is available on the university’s campus.

Calgary police confirmed last month they were investigating the incident. The university also reported the incident to the Alberta Information and Privacy Commissioner.

The school said it’s offering all current employees, and anyone who was employed by MRU in the last five years, with two years of credit monitoring and identity theft protection services as a precautionary measure.

Corporate data about the university is primarily what’s at risk in the cyberattack, the university said. It argued student information does not present the same risk profile, which is why it is not offering credit monitoring to students.

“Further analysis of the affected data and recoverability will take additional time and may be several weeks or months. Updates will be provided as they become available,” MRU’s statement read.