Mount Royal University Confirms Breach; CMD Organization Claims Attack
Summary
Mount Royal University says a June 17 breach disrupted services and an unauthorized actor took data from some H drive folders before originals were wiped. CMD Organization claims the attack and demands 30 BTC; J drive data was deleted, with no evidence it was copied.
Key points
- Mount Royal University says a June 17 cyberattack disrupted online services, internet access, and some internal systems.
- The university’s investigation found that an unauthorized actor accessed and took data from certain H drive folders affecting students, employees, and others.
- The original H drive data was wiped, complicating efforts to determine the impact on individuals.
- A separate J drive containing departmental data was deleted; the university says there is no evidence its data was accessed or copied, and full recovery may not be possible.
- CMD Organization claims responsibility, published samples of allegedly stolen documents, and demanded 30 BTC, threatening to leak the data after six days.
- The university reported the incident to Alberta’s Information and Privacy Commissioner and law enforcement, and is offering two years of credit monitoring and identity theft protection to eligible people.
Article Details
- Victim Organization
- Mount Royal University
- Incident Type
- Network breach involving data theft and deletion of files, with disruption to university systems.
- Data Types Exposed
- Data in certain H drive folders affecting current and former students, current and former employees, and other individuals; specific contents have not been determined.
- CMD Organization published samples it described as stolen data, including passport scans and other sensitive documents; the samples are alleged to be stolen from the university.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The university confirmed that a cyberattack on June 17 disrupted online services, internet access, and certain internal systems. Data in certain H drive folders was accessed and taken, and original copies were deleted. The separate J drive, which stored departmental data, was wiped; the university said there was no evidence its data was accessed or copied before deletion. Recovery may take several weeks to months, and full recovery of J drive data may not be possible.
- Ransom Or Extortion
- CMD Organization claimed the attack, demanded 30 BTC, and threatened to leak the allegedly stolen information if the university did not respond within six days. The group also reportedly offers stolen data for sale through an auction-style system. The ransom demand and threat are claims by the group.
- Claim Status
- confirmed