BE questions Government on cyberattack to the University of Aveiro

Na question delivered to the parliament, dated Sunday and consulted today by the agency Lusa, the MP of the Block Andreia Galvão recalls that the latest information on cyberattack occurred on 30 July, when the National Cybersecurity Center (CNCS) provided clarifications on the case.

Since then, there is no new public information, says the blogger adding: “It is not known which database was exfiltrated, what categories of data it contains, how many people are affected, whether the data were published, whether there was negotiation with the attackers, which was the input vector, or whether an independent forensic audit was performed.”.

In the document, she points out that the AU is based its virtual private network service (VPN) on the technology of a company based in Tel Aviv and that the incident in question “has occurred in the midst of a sequence of critical vulnerabilities actively exploited” in the products of this company that support VPN services.

“ A university that bases its safety perimeter on a product affected by three active exploration vacancies in five months, and that suffers a ransomware attack with exfiltration in the same interval, owes its community and guardianship a clear response about the installed versions, the dates of application of corrections and the results of forensic analysis ", defends Andreia Galvão.

The Bloc also claims to have received reports from members of the academic community of the AU that, after the attack, the university's network had frequent failures, and was practically inoperative in several days, at the start of the school year, without the institution having explained to the community the origin of the problems, their relationship with the incident or the measures under way.

In this question, addressed to the Ministry of Education, Science and Innovation, the MP of the Bloc asks for information on “when and why the Ministry took knowledge of cyberattack to the University of Aveiro, and what information it has received from the institution since”.

Andreia Galvão also wants to know what the conclusions of the forensic audit have been and what support has been given to those people whose mailboxes have been copied, in particular the risk of fraud and directed ‘phishing’.

“ What database has been exfiltrated, what categories of personal data does it contain, and how many people are affected? Have the exfil data been published or made available for sale? Have the attackers been identified?" she asks.

On July 29, the AU reported that undue access to its information systems had been detected, which resulted “in the exposure of personal and institutional data”.

Contacted at the time by Lusa, the rector of the AU, Artur Soares da Silva, explained that the attack had taken place “a few days” before, but they only realized the extension on 28 July.

“ We know there's been a crime, there's been undue access to our information. So far, we don't think there's been any loss of information. There was a copy of information and we do not know the extension ", said the dean.

Artur Silva also said that there was “a small number” of e-mail accounts that had been violated, advancing that people were being informed of this situation, because their contents could be disclosed.

On July 30, CNCS source required CERT.PT to be notified on July 20, which had been a ransomware attack with exfiltration of information from e-mail boxes and at least one database.

The same source also indicated that the incident had been reported to the PJ and the National Data Protection Commission (CNPD), and that they had asked the AU for the necessary elements for the analysis of the incident and recommended the adoption of additional security enhancement measures.

The entire academic community, including students, teachers and researchers and employees, was forced to change the password.