Scottish university hit by Rhysida ransomware gang

Data supposedly stolen from the University of Western Scotland (UWS) in a ransomware attack has been put up for sale on the dark web by a newly emergent ransomware gang going by the name of Rhysida, which is asking for approximately £450,000 in Bitcoin, with plans to sell it to the highest bidder in the next few days.

According to the BBC, the incident began earlier in July and caused a brief period of downtime across some of UWS’s key systems, including its public-facing website.

The data on “offer” supposedly includes the personal details of staff members, including financial and National Insurance data, and a number of internal university documents.

A UWS spokesperson told Computer Weekly that the organisation had been the victim of a cyber crime affecting a number of digital systems.

“All appropriate steps continue to be taken to manage the situation,” they said. “The incident remains an ongoing criminal investigation and we continue to work closely with the relevant authorities, such as Police Scotland, the National Cyber Security Centre [NCSC] and the Scottish Government, who are providing support and advice. We have also reported the incident to the Information Commissioner.

“Working alongside these agencies, we are following a controlled process to work towards a resolution. We have been briefing colleagues and students since the start of this incident, and have advised colleagues that some staff data has been accessed. Staff continue to be contacted directly and provided with information and support. Our priority remains to ensure our university community and partners continue to be informed and supported at all times, while we work with law enforcement agencies as part of the ongoing criminal investigation.”

UWS said it was not able to address additional questions this time, and nor did it confirm whether or not the data dump was genuine or not.

Stolen documents