University of Galway data breach affected almost 190 people, financial statements reveal

In October 2024, the data breach was discovered at University of Galway when an auto forwarding rule was found in place on a staff member’s email account which they had not implemented. File picture

Nearly 190 individuals had their personal data breached in an incident discovered at University of Galway in 2024 involving a third-party fraudulent actor whose access began at an unknown point in time.

The data breach was discovered in October 2024 when an automatic forwarding rule was found in place on a staff member’s email account that they had not created.

The rule forwarded emails from the staff member’s mailbox containing the keywords “Invoice”, “Wire”, “Transfer”, “Payment” and “Remittance” to a non-university Gmail account.

“This rule appears to have been put in place by a third-party fraudulent actor, likely due to a compromise of the staff member’s email account at an unknown point in time,” the university’s recent financial statements note.

“The staff member’s account was reviewed and was not compromised at the time of the breach coming to light.”

However, subsequent investigations could not determine the date of the initial compromise due to the time elapsed. It took place sometime between September 2018 and March 2021, the statements note.

“Upon discovery, mitigating actions were immediately taken to prevent further data loss. The Data Commissioner was notified within the required timeframe.”

187 individuals affected

The university also launched an investigation. 

However, it was “significantly hampered by the passage of time and the lack of availability of logs for the entire period”.

Ultimately, it found that 187 individuals’ personal data had been breached and that they "were considered high risk". Those affected were notified of the data loss.

"The university continues to monitor and improve its systems and practices in line with best practice."

Student records system

As previously reported, University of Galway has spent €10.6m to date on a new student record management system that remains "uncompleted" three years after its original deadline, following significant delays and development challenges.

Details on the student record management system are included in the most recent financial statements published by the university.

The university has also "effectively" written off €1.6m in costs associated with the project, which forms a key part of a broader programme to modernise how the university processes and manages student data.

University of Galway also spent a further €552,000 on contract dispute resolution relating to the project, including mediation, legal review and consultancy costs.

• Jess Casey, education correspondent