This story was updated with new information on July 21 at 2:49 p.m. Students and staff at Mount Royal University are concerned and frustrated after a cyber attack targeting the school last month compromised thousands of people’s sensitive information. The Calgary university reported the cyber breach on June 18, and weeks later revealed an unauthorized person accessed and erased data from some university computer folders in a ransomware attack. MRU says it is trying to recover the data, but it might not be possible to get everything back. Security experts say CMD Organization is taking responsibility for the attack, and that the group has already leaked some private information online to attract bidders. “MRU’s data is just one of a number of organization’s data that’s been listed, however the auction site for university’s data has disappeared,” said security expert Shaanan Cohney. “Does this mean they’ve sold it to the highest bidder or has the university paid a ransom?” In the meantime, students can’t register for classes or access information such as transcripts, which are needed to apply for other universities. Some former students can’t even apply for certain jobs without those documents. “I’m quite frustrated and stressed out about it all,” one recent graduate told CTV News. The student, who CTV News is not identifying because her information was compromised, graduated from the nursing program and needs her transcripts to get her licence in Australia, where she is planning to live. “(It) raises questions about when I’m able to move forward with my life,” she said. She added she first tried to access the documents June 17 but was unable and has been calling and emailing MRU almost daily since. She said MRU provided an explanation letter about the cyber threat, but Australian authorities said they still require the transcripts for the woman to get her nursing licence there. The former student wonders if MRU keeps paper transcripts which can be pulled, but has yet to receive answers. Many also worry about the long-term risks after their personal information was exposed, including some who have been targeted by stalkers and threatened by students in the past. “A lot of personal information on employees potentially is out there, as well as students,” said criminology professor Kelly Sundberg. Sundberg was previously targeted online and in his office resulting in safety concerns involving MRU Campus Security and Calgary Police Service. He worries data compromised in the breach include home addresses, family details and banking information. MRU is offering credit monitoring to current and former employees, but not to students. Some say it is too little too late. Sundberg wants Alberta’s minister of advanced education to investigate. “There needs to be an investigation into the decision making and operation and management of this university because we are talking hundreds of millions of tax dollars,” Sundberg said. “This is not only an erosion of the institution but for those like myself who focus on security and safety. It’s an embarrassment.” It’s not the only recent security incident at the university raising concerns. In April, someone was spotting carrying a large knife around campus. The university was locked down but not all students received the emergency alert that was sent to the MRU app as it “had gone dormant as happens when it is not used for a period of time,” the university said. The incident turned out to be a chef walking with a knife, but some called it a wake-up call for the university to look at its security protocol. MRU declined CTV News’ request for an interview, instead sharing a statement saying it “recognizes the cyber incident is concerning to many” and it “continue(s) to work with law enforcement and focus on full restoration of services.”
