Sign in. It’s quick, free and it’s up to you.
An account is an optional way to support the work we do. Find out more.
MAYNOOTH UNIVERSITY HAS confirmed it was a victim of a widespread cyber hack in which data pertaining to students and alumni was stolen.
The attack occurred in May and was targeted at Blackbaud, a software company which provides software and cloud management systems to third-level institutions, including Maynooth University.
A number of institutions were affected by the hack, including NUIG which in July moved to reassure students that its data would not be used or disseminated after Blackbaud paid a ransom in exchange for the stolen files being destroyed.
Blackbaud at the time refused to list the institutions affected by the attack but in a letter to students and alumni of Maynooth University and seen by TheJournal.ie the college confirmed it was alerted to a breach on 16 July.
“On the 16th July, we received notification of a security incident from a third-party service provider, Blackbaud,” the letter said.
“They advised us that they were a victim of a ransomware attack in May 2020. After discovering the attack, Blackbaud’s cybersecurity team – together with independent forensic experts and law enforcement – successfully prevented the cybercriminal from blocking their system access and fully encrypting files, and ultimately expelled them.
“However, before being locked out, the cybercriminal removed a copy of a backup file containing personal information including a subset of Maynooth University data.
“Blackbaud paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed.”
The university said it launched its own investigation and, following this, is now able to notify affected parties.
It said data including the names, date-of-birth, addresses, and academic qualifications may have been stolen in the attack but there was no evidence that credit cards, bank details or passwords were accessed.
The university said: “Based on the nature of the incident, their research, and a third party (including law enforcement) investigation, Blackbaud does not believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly and are continuing to monitor this.”
It said the Data Protection Commissioner has been notified of the breach, it said, and the university is “reviewing our relationship with Blackbaud as a service provider”.
A spokesperson for the Data Protection Commissioner confirmed it has been notified of the breach.
Students and alumni of the college will not need to take any action but should “remain vigilant and report any suspicious activity or identify theft to the proper authorities,” the letter states.
“We sincerely apologise to you for this incident,” it added.
Maynooth University did not immediately respond to a request for comment.
It should be illegal to pay ransoms. It just encourages these type of things. Nobody was going to die ffs
Got the letter today
@Declan Holden: me too
@Michael Carolan:
Me three!
@Declan Holden: Yep so did I
We pinky promise that we will destroy the data. Ok here’s lots of bitcoin.
@Synester Gates: It’s in the hackers interest to keep up their end or people will stop paying the ransoms.
Nice to hear maynooth is doing a piss poor job running a IT system
@Barry: read again… Blackbaud was the subject of the attack.
@Canyon: Data stored on US servers though. Not very professional to let Irish students data be hosted outside EU protections.
@John Murray: fully agree, EU data protection standards are far higher the USAs.
@Barry: not their fault
@John Murray: At the time this transfer of data was likely understood to be covered and permitted under the EU-US Privacy Shield (since declared invalid by an ECJ ruling), but do you really think that the geographical location of the infrastructure would have had a bearing on the cybersecurity measures taken to secure the infrastructure and thus the data?!l
EU data protection measures still applied to transfers under the Privacy Shield legislation, so your claim is rather specious.
How can they trust the criminals to get rid what they stole?
Somebody obviously wasn’t happy about not getting an honours degree!!
@Niall Gannon: in computer science
@Niall Gannon: I don’t think it matters much whether you get a First or a Third from the Catholic Seminary. They tossed out the clerics and replaced them with the sons and daughters of Tipperary pig farmers
@Jane Aelst: You’re obviously a Maynooth University student
Embarrassing
@Bill: oh ffs any reason to criticism it was blackbaud fault
Maynooth university teaches that crime pays so.
@Larry Murphy: no maynooth isndiverse now ff with your narrow ideologies bi studied business here nothing to do with farner or Catholic college
@Larry Murphy: maynooth not atvfault bkacmbuad is get your facts right
The rule has to be that you never, ever, ever pay ransoms to those people. Ever. What’s the worst thing that they could have done with those students’ personal data?
@Mick Hyland: wasn’t maynooth was blackbuad
Wha? Just names addresses qualifications stolen…so what?….no bank details or credit cards robbed why was a ransom paid?. You get all that data on LinkedIn anyway.
@Peter B: wasn’t maynooth anyway
Name, addresses, date of birth and academic results… No mention of PPSN… Oh well that’s OK then.
I’m in third and final year in Maynooth social science and I can’t believe they paid a ransom
@Alison Maguire: Blackbaud paid the ransom not the university
@Alison Maguire: they didn’t itnwas data holder get facts right
@jnulty17@gmail.com: ok my mistake
An academic institution with academic minds and academics working while being paid by the taxpayer had to succumb to a cybergangster’s threats because no one in said institution was intelligent enough to scupper the villain and spoil the plot!
How many academics does it take to change a lightbulb?
@Lao Tzu: Two. One to unscrew the bulb and the other to stand idly by and mercilessly critique his colleague’s actions
@Lao Tzu: complain again taxpayers excuse for everything
Hard to believe they actually paid the hackers to destroy their hacked info… The mind boggles…
have your say