Students and staff impacted by MTU cyber attack to be contacted directly 

Simon Harris told the Dáil on Wednesday that the full impact of the attack and what details have been published on the dark web is not yet known as specialist forensic services are still reviewing the breach. Picture: Larry Cummins

Students and staff at Munster Technological University (MTU) who may have been compromised following a major ransomware attack that has seen stolen data published on the dark web will be directly contacted shortly.

A forensic analysis is currently underway following the significant breach to assess the extent of the stolen data, the nature of the data compromised, and any data that may have leaked online.

Further and Higher Education Minister Simon Harris told the Dáil on Wednesday that the full impact of the attack and what details have been published on the dark web is not yet known as specialist forensic services continue to review the breach.

“If anyone has been impacted, staff or students, they will shortly receive a specific letter of contact from MTU.” 

Mr Harris was answering a question put to him by Fianna Fáil TD for Cork North-West Aindrias Moynihan, who called on Mr Harris to outline the extent of the attack, and if people's personal details have been compromised.

“There’s some 13,000 students at present, and over 1,000 staff. People have been outlining concerns about the publication of possibly their data,” Mr Moynihan said.

In addition to current students, there are tens of thousands of people who are past students and staff, possibly also parents who had been paying fees, he added. 

The HSE is currently issuing letters to people affected by its major ransomware cyber attack, from May 2021.

“Many people would have assumed at this stage if they hadn’t gotten correspondence then they were clear of that attack.” 

He asked how soon can people affected by the MTU cyber-attack expect to be notified and also asked if research data or transcripts data had been compromised.

Cyber-attacks don’t often occur in isolation and often there are other “exploratory probing efforts” first, he added. 

“Was the MTU cyberattack caught on the first attack?”

In response, Mr Harris said cybercrime and cyberterrorism are “an ever present and growing threat to the safe operation of our institutions.” 

Simon Harris said 'truthfully' he didn’t know if this was the first attempt to get into the MTU system.

MTU is working closely with the National Cyber Security Centre in relation to the breach, he added.

“MTU staff and students that may have been affected will now receive specific communications from MTU and all have been advised to remain extra vigilant to any potential phishing attacks by email or SMS or by any other unsolicited communications.” 

Forensic investigation

Specialist forensic services are currently reviewing the nature of the data compromised and any data that may leak online.

“The honest answer that I have to give is that work is ongoing by those specialist forensic services in terms of analysing exactly the extent of the data that might have been taken.” 

An interim High Court order has been granted, and MTU has contingency plans in place which have allowed working and learning to resume for the majority of staff and students.

“We need to continue to beef up and further resource the structures in place to protect people where possible from such crimes,” Mr Harris said. 

Funding has been granted through HEANET for cybersecurity resources to the third-level system, and the department is also now providing funding to "mobilise a sectoral security operations centre and security incident event management service” to the education centre.

This includes 24/7 detection and response capabilities.

Mr Harris said “truthfully” he didn’t know if this was the first attempt to get into the MTU system.