University of Utah Pays Almost $500K Ransom
The University of Utah paid over $450,000 ransom payment after a ransomware attack hit the university's servers. The university's servers for its College of Social and Behavioral Science Unit were targeted and temporarily inaccessible. The university downplayed the attack's impact, stating that no central university IT systems were compromised, and that only .02 percent of the data was affected. The university said that affected data included employee and student information, but didn't say what kind data it was. The university notified their students, faculty and staff to change their university passwords after the attack.
The affected servers have been isolated from the rest of the university and the internet,. Law enforcement and an outside consultant are currently investigating the attack. The university also didn't state how the hackers were able to access its servers in the first place other than stating that "This incident helped identify a specific weakness in a college, and that vulnerability has been fixed."
The university decided to work with its cyber insurance provider to pay the ransom. The university stated that it was done as a proactive and preventive matter to ensure information was not released on the internet. The university was able to recover almost everything from backups. The cyber insurance policy paid part of the ransom and the university covered the remainder. According to university officials, no tuition, grant, donation, state or taxpayer funds were used to pay the ransom.
The University of Utah is the latest in a string of attacks that have been hit and many have paid the ransom. The University of California, San Francisco paid a $1.14 million ransom to recover data that included important academic work. The data was encrypted after the NetWalker ransomware reportedly hit the UCSF medical school.
Ransomware attacks have been increasing in the U.S. for the first half of the year. Unfortunately, organizations are still vulnerable to ransomware attacks. There has been several incidences of organizations being hit by ransomware using targeted phishing attacks. With more organizations that are working remotely, businesses are facing new and bigger cyber-risks.