East Central University says BlackSuit ransomware group encrypted file servers, stole students' data

Oklahoma-based East Central University said it experienced a major ransomware attack that compromised the sensitive personal information of its students and encrypted several utility and file servers.

 

Based in Ada, Oklahoma, East Central University (ECU) is part of Oklahoma’s Regional University System and enrolls more than 3,500 students every semester from more than 30 countries and 25 states.

 

In a data security incident notice posted on its website, ECU said that on February 16, it experienced a ransomware attack and immediately engaged third party cyber security experts to investigate the incident and understand the nature and scope of the same.

 

The experts, along with ECU’s IT team, also helped the University to stop the attack and recover from the same. Additionally, the University’s IT team began resetting passwords, evaluating critical services, and deployed new servers to restore services that were affected by the attack.

 

“While the criminals were not successful in taking down ECU’s critical services, they were able to conduct a successful attack on a variety of campus computers. The criminal group attempted to attack ECU systems, steal data, encrypt ECU computers, and otherwise extort the campus,” the University said.

 

ECU said that the threat actors encrypted multiple utility and file servers, but critical university systems, which had additional security in place, were not affected by the attack.

 

The University confirmed that the ransomware attack was carried out by the BlackSuit ransomware group who attempted to “gain entry through infected email attachments, malicious websites, pop-up-ads, and a variety of trojan applications.”

 

“While we cannot definitively say how the attackers were able to get in, we did see an increase in spam/malicious emails in the days leading up to the attacks,” ESU said in the FAQ section of a dedicated webpage set up to address queries about the incident.

 

Though ECU initially said that it found no evidence of data exfiltration, it later admitted that the ransomware group accessed the sensitive personal information, including names and Social Security numbers, of its students.

 

The University has set up dedicated email and phone numbers for affected individuals to get their queries answered. It has also assured its students and staff that it will share more details about the ransomware attack as and when available.

 

Last month, California-based Select Education Group said it experienced a cyber security incident that resulted in unauthorised access to portions of its internal network. The cyber attack that affected at least 67,097 individuals, was claimed by the BlackSuit ransomware group, who listed the institute as a victim on its data leak site.

 

In December, the ransomware group also claimed that it infiltrated the network of Indiana-based DePauw University  and stole up to 214 GB of data from the University’s systems.