University of the West of Scotland (UWS) targeted in cyber attack

Data allegedly belonging to the University of the West of Scotland (UWS) has been put up for auction by a cybercrime gang.

UWS said they have been the “victim of a cybercrime” which has affected “a number” of their digital systems.

The ransomware gang known as Rhysida is demanding 20 bitcoin – the equivalent of just over £450,000 – and says it will be sold to the highest bidder.  

Police Scotland are investigating the incident, having first been alerted to the breach at the beginning of July. At this point the university’s website was down.  

While UWS is working with Police Scotland, the National Cyber Security Centre and the Scottish Government while a criminal investigation is underway, it has briefed staff and students “since the start of this incident” advising that “some staff data has been accessed”.  

No crime group claimed responsibility for the attack initially, but Rhysida has since claimed to be behind the attack and has seemingly attempted to use the compromised data to extort the university.  

The gang’s webpage, which can only be accessed via the deep web, is advertising personal data allegedly belonging to staff such as bank details, national insurance numbers, and internal university documents.  

A BBC investigation confirmed that the listing was real but was unable to verify the authenticity of the data.

Rhysida was first observed earlier this year after it launched a cyber attack on the Chilean army. Since then, they have attempted ransomware attacks on organisations across the world.  

According to the cyber security website Sentinel One, the group pose as a “cybersecurity team” looking for flaws in victims' online security.  

A spokesperson for the University of the West of Scotland said: “The university has been the victim of a cybercrime which has affected a number of digital systems.

“All appropriate steps continue to be taken to manage the situation. The incident remains an ongoing criminal investigation and we continue to work closely with the relevant authorities, such as Police Scotland, the National Cyber Security Centre and the Scottish Government, who are providing support and advice. We have also reported the incident to the Information Commissioner.

“Working alongside these agencies, we are following a controlled process to work towards a resolution. We have been briefing colleagues and students since the start of this incident and have advised colleagues that some staff data has been accessed. Staff continue to be contacted directly and provided with information and support.

“Our priority remains to ensure our university community and partners continue to be informed and supported at all times, while we work with law enforcement agencies as part of the ongoing criminal investigation.”

A Police Scotland spokesperson said: “An investigation is underway following a report of a cyber incident in Paisley. The matter was reported to police on 3 July, 2023 and enquiries are ongoing.”