SAN ANTONIO – A new semester at the University of Texas at San Antonio was scheduled to begin Wednesday. Instead, students are waiting another week to return to class after the university detected an attempted cybersecurity breach and took some systems offline as a precaution.
UTSA said the attempted attack was stopped before reaching its core systems. The university has not said student or university data was stolen, and officials have emphasized that the investigation and security response are ongoing.
The attempted attack has disrupted some online services and forced the university to adjust several deadlines as it works to restore systems and prepare for the delayed start of the fall semester.
But cybersecurity experts say the attempted breach also illustrates a much larger problem facing universities and other large organizations: attackers do not necessarily need days or weeks to find a target.
They may need only minutes.
Richard Hummel, vice president of threat Intelligence at SecurityScorecard, has spent nearly two decades working in cybersecurity, including threat intelligence involving nation-state actors, cybercriminals and other malicious groups.
His team monitors cybercriminal activity worldwide, including claims made on hacker forums, messaging platforms and social media.
When an attacker claims to have breached an organization, Hummel said security researchers initially treat that claim as an allegation. Researchers then look for evidence confirming whether the breach actually occurred.
That can include public disclosures from an organization, evidence that stolen data is being sold or confirmation from other sources.
Hummel said the speed at which attackers scan for vulnerable systems is a separate and increasingly urgent concern. But he said the basic lesson remains the same.
“The moment a device comes online, has a public IP address, it’s available for anything out there to scan,” Hummel said.
For organizations, that means cybersecurity defenses must be in place before a system connects to the internet — not after an attack begins.
Universities face unique challenges
Universities face a particularly complicated cybersecurity environment. Thousands of students, faculty and staff may connect personal computers, phones, tablets and other devices to university networks. Unlike a traditional corporate environment, a university has less control over many of those devices.
That creates more potential entry points for attackers. Hummel said the university’s ability to stop the attempted breach before it reached its most critical systems is an important distinction.
“The fact that they were able to catch this and stop this before it hit critical systems speaks to the fact that they’re doing a lot of the right steps,” he said.
He pointed to network isolation, permissions and other security controls as potential reasons an organization can prevent an intrusion from spreading.
UTSA has not publicly detailed the specific techniques it used to stop the attempted attack.
AI lowering the barrier to entry
Cyberattacks have traditionally required a certain level of technical knowledge. An attacker might have needed to understand networking, identify a target’s systems, conduct reconnaissance and create or modify tools to exploit a vulnerability.
Hummel said artificial intelligence is changing that equation. Cybercriminals have increasingly used automated tools and AI agents to help determine how to attack a target, he said. Some systems can help users move from identifying a target to selecting potential attack methods.
Hummel said unrestricted AI models could make that process even easier.
“There is zero barrier to entry anymore,” he said. “If you have a computer and you have the internet, you have the capability.”
That does not mean every internet user is capable of successfully breaching a major university, but Hummel said the tools have lowered the technical knowledge needed to attempt malicious activity.
What attackers want
So what are attackers after? For many cybercriminals, the answer is money.
Hummel said criminal groups can operate much like businesses, with different participants specializing in areas such as stealing information, hosting infrastructure, moving money or distributing spam.
Ransomware groups, for example, may steal data and encrypt systems before demanding payment.
Some groups use multiple forms of extortion, threatening to keep systems locked, publish stolen information or launch additional attacks if victims refuse to pay. The common factor, Hummel said, is that large organizations have to prepare for multiple types of threats.
Hummel said organizations need to identify the systems they absolutely cannot afford to lose and make sure those systems are protected and capable of continuing to operate even during an attack.
How to protect yourself
Hummel recommends people learn what common cyberattacks look like.
Phishing emails, fraudulent password resets and unexpected multifactor authentication requests can all be used to trick people into giving attackers access. He added that people should not assume they are too smart or too careful to become victims.
Think about which accounts would cause the greatest problems if they were compromised, he said. That could include email, banking, credit cards and other financial accounts.
Using unique passwords, a password manager and multifactor authentication can reduce the risk that one compromised password will provide access to multiple accounts.
For now, the attempted breach at UTSA is still being investigated, and the university has not indicated that its core systems were compromised.
But Hummel said institutions should view incidents like this as a reminder that cyberattacks are no longer unusual events reserved for the largest technology companies.
Read also:
Copyright 2026 by KSAT – All rights reserved.
