MTU pays out €3.5m for cybersecurity review after IT attack

The measures were in response to a cyberattack on MTU Cork last February, which caused the campus to temporarily close following the 'significant' breach

Munster Technological University (MTU) suffered a cyberattack last February which has cost it €3.5m in direct costs to date. Picture: Larry Cummins

The cyberattack that targeted Munster Technological University (MTU) Cork last February has, to date, cost MTU €3.5m in direct costs.

That is according to MTU’s 2022 annual report, which outlines a number of measures MTU has taken to strengthen its online security against any further cyber attacks.

As a result of the cyberattack, the TU Cork campus was closed temporarily following the “significant” IT breach and phone outages.

The Kerry campuses remain unaffected and, as part of the cyberattack, a ransom had been demanded, but MTU had “not engaged”.

Arising from the incident, MTU had engaged in close contact with the National Cyber Security Centre, the Data Protection Commission, An Garda Síochána, and other relevant stakeholders.

The annual report states that “following a cyberattack in February 2023, a large body of work is underway across the MTU IT environment to best align IT systems with leading practices in relation to both IT security, environment recovery, and data integrity/monitoring”.

The report states that the university “engaged the services of KPMG to review and implement many of these measures to date”.

One of the measures in place is a Security Operations Centre as a Service (SOCaaS) “and the SOC team is to monitor the IT landscape and support the ISS team in responding to threats identified in the security information and event management (SIEM) database”.

The measures include “enhanced perimeter defence systems, web application firewall and web application proxy, and are deployed to protect against external threats to MTU systems”.

The report states that multi-factor authentication (MFA) is in place for all staff and students.

The report also states that security awareness training is provided on a continuous basis and simulated phishing exercises undertaken. The post of chief information security officer is in place, managing risk assessment across IT. The report states that “the direct costs associated with the breach currently stand at €3.5m”.

Separately, the report also discloses that weaknesses in relation to compliance with procurement rules and guidelines were identified, and €2.718m expenditure was incurred where the procedures employed did not comply with the guidelines.

The report states that the main reasons for non-compliance were international student recruitment, outsourced course delivery, and delays in capital projects due to covid-19.

MTU recorded a surplus of €5.27m in the 12 months to the end of August 2022. The university recorded income of €228.54m and costs of €223.18m.

The university’s largest cost was staff costs of €128.15m, as numbers employed increased from 1,665 to 1,718. One staff member was paid in excess of €160,000, while three staff members earned between €120,000 and €130,000.

An additional 21 earned between €110,000 and €120,000, while another 40 received between €100,000 and €110,000.

Hospitality costs totalled €105,000, while professional fees increased from €1.7m to €4.5m. Income included €90.65m in State grants, while tuition fees and student contribution income totalled €54.49m.

The university also received €23.97m in student support funding. The surplus takes account of €8.9m in non-cash depreciation costs.