Scottish University Data for Sale on Dark Web: Cyber Extortion Gang Demands 20 Bitcoin
The University of the West of Scotland (UWS) has fallen victim to a cyber-extortion gang, which is now advertising confidential data from the institution for auction on the dark web. The university confirmed that its systems were compromised, resulting in the unauthorized access of staff data. The ransomware group responsible, known as Rhysida, is demanding 20 Bitcoin (equivalent to £450,000) in exchange for the data, which they intend to sell to the highest bidder.
This incident follows the temporary shutdown of the UWS website in early July, following what was referred to as an incident. The institution, which has campuses in Paisley, Ayr, Dumfries, and Blantyre, is now working alongside the National Cyber Security Centre, Police Scotland, and the Scottish Government to address the attack.
A spokesperson for UWS stated that all appropriate steps continue to be taken to manage the situation, emphasizing that the incident is an ongoing criminal investigation. The university has reported the incident to the Information Commissioner and is cooperating with law enforcement agencies in pursuit of a resolution. The affected staff members are being contacted individually and provided with the necessary support and information.
FalconFeeds, a threat intelligence platform, has identified the Rhysida ransomware group as being responsible for the attack. According to FalconFeeds, eight out of the 32 victims targeted by this cyber-extortion gang are educational institutions. The attackers have listed the stolen data for auction on their dark web portal, setting a seven-day deadline for bids.
Police Scotland has confirmed that an investigation is in progress following the report of the cyber incident in Paisley. Inquiries are ongoing since the incident was reported on July 3, 2023.
As the situation unfolds, it is crucial for educational institutions and organizations to remain vigilant and prioritize cybersecurity measures to safeguard sensitive information. The authorities and security agencies are actively involved in addressing this incident, but it serves as a reminder of the persistent threat posed by cybercriminals in the digital landscape.
