U of W paralyzed by cyber incident ‘I am dead in the water right now, and so are my students,’ prof says By: Tyler Searle Posted: 6:39 PM CDT Tuesday, Mar. 26, 2024 Last Modified: 8:28 PM CDT Tuesday, Mar. 26, 2024 Updates

Weeks before exams are set to begin, students and faculty at one of Manitoba’s largest universities are scrambling to access academic files after a weekend “cyber incident” knocked out network access and forced the institution to cancel classes.

Lessons at the University of Winnipeg resumed Tuesday after a one-day hiatus, but many educational services remain unavailable, including Nexus — the school’s learning-management system, in which many professors store and disseminate the bulk of their curriculum.

“Right now, I have no way of contacting students. They’ve lost access to all of the course materials,” biology professor Scott Forbes said. “We are just about to start exams, so this is just about as bad as it gets…. Basically, I am dead in the water right now, and so are my students.”

More than 9,000 students enrolled at the university were told not to attend classes Monday after the campus Wi-Fi was disabled and an assortment of critical, web-based academic programs became inaccessible. School officials initially described the issue as an internet service outage but later said it was linked to some form of “cyber incident” discovered Sunday.

“We are just about to start exams, so this is just about as bad as it gets…. Basically, I am dead in the water right now, and so are my students.”–Professor Scott Forbes

The university confirmed Tuesday the outage was the result of a cyber attack; It would not say whether any student or institutional data was compromised, as a result.

“At this early stage, we’re still in the process of investigating the incident to better understand its impact — and also don’t have a solid ETA for when all systems will be available again,” a spokesperson said in an email statement.

In a separate statement posted on its website, the university provided an update, saying it has taken “immediate steps to secure its network, which included making a variety of services unavailable.”

“We appreciate that this incident raises concerns within our campus community, and.… We are working with expert partners to resolve the incident and have reported it to the authorities,” it said.

The university notified the Winnipeg Police Service and the Canadian Centre for Cybersecurity about the attack, the spokesperson said.

The WPS confirmed it received the report, but declined to elaborate on the potential cause.

The police force investigates cyber-related incidents that involve ransomware attacks, denial-of-service attacks, network intrusions and data breaches, it said via email.

“I just hope the university is honest about what happened.”–Student Ian Gawletz

The Office of the Manitoba Ombudsman — which is tasked with overseeing privacy legislation and investigating serious information breaches — would not say whether it received reports of the incident.

Advanced Education Minister Renée Cable has been briefed on the incident, her office confirmed.

The university was able to restore campus internet services Monday night after establishing a temporary network.

Campus phones, electronic doors and a suite of Microsoft 365 programs were operational, but access to the printers and the Nexus, Colleague, VPN and Web Advisor systems remained unavailable Tuesday.

Attendance was noticeably low, said student Ian Gawletz, who arrived to find only four other students in his first class of the day.

The geography major, who is in his final semester, said he is anxiously awaiting updates from the university.

“I just hope the university is honest about what happened. Maybe they really don’t know the extent of what’s going on, but especially with your financial and personal information… if that gets out in a data leak, that’s obviously very important,” he said.

He pointed to the Web Advisor system as an area of particular concern, saying it is used to pay for courses and, if breached, hackers may be able to access sensitive financial information.

He was not alone in his fears; numerous students chatting in the hallways, cafeteria and elevators inside the various faculty buildings were overheard discussing the potential fallout from the incident and speculating on its cause.

Educational institutions, businesses and non-profit organizations are increasingly becoming targets of criminals who hold digital infrastructure and data at ransom in exchange for money, said Hernan Popper, founder of Popp3r Cybersecurity Consulting Inc.

“Anywhere they can find an attack vector to exploit, they will,” he told the Free Press, speaking generally on cyber security.

All organizations are vulnerable to cyber attacks, Popper said, pointing to data from the 2022 Verizon Data Breach Investigations Report which found up to 82 per cent of information breaches are caused by human error.

“Anywhere they can find an attack vector to exploit, they will.”–Hernan Popper

Such crimes are typically perpetrated by criminal organizations that use sophisticated methods to trick people into clicking on suspicious links or downloading corrupt files.

Once inside a network, they may steal data or lock the organization out of its own systems. Often, the crime is not discovered until up to eight months after the initial breach.

Criminals then threaten to destroy, hold indefinitely or leak the captured data. Sometimes, they will use the information to attack other businesses or individuals connected to the victim, Popper said.

According to a 2021 report from the Canadian Centre for Cyber Security, the estimated average cost of a data breach that includes ransomware is $6.35 million.

Popper said he has worked with several Winnipeg businesses and organizations that have fallen victim to the crime.

He encouraged all organizations, regardless of their size or the sensitivity of their data, to review their cyber-security measures and consider purchasing additional insurance.

“I’ve heard the pain and I’ve felt the pain of people going through an event.”–Hernan Popper

“I’ve heard the pain and I’ve felt the pain of people going through an event,” he said.

St. Amant, a health-care organization that supports children and adults living with disabilities, was targeted by criminals who demanded ransom after a cyber attack in 2022.

A subsequent investigation did not find any evidence that information was downloaded or saved by the hacker. However, private information was potentially leaked, St. Amant said later.

Exams for U of W’s winter term officially begin April 11.

— with files from Nicole Buffie

tyler.searle@freepress.mb.ca