Canadian University Held Hostage By Hacker Threatening To Release Student Data

A university in British Columbia, Canada has fallen victim to a hacker who is holding student information hostage and demanding the administration pay a steep ransom or have the data published online.

The hacker has demanded the University of the Fraser Valley (UFV) in Abbotsford pay 30,000 in Canadian dollars (about $23,000) or risk personal information of its more than 15,000 students be made public.

While it’s not clear exactly how much information the hacker—or hackers—have obtained from the university, the attacker did offer up proof of the hack’s legitimacy by sending an email to UFV students that contained the personal information of 29 of their classmates.

It is believed the hacker has a considerable amount of information that the university stores for each student, including birth names, physical addresses, email addresses, phone numbers, grades and limited financial details.

Given the type of information that is often collected by universities, it’s also possible the hacker may have information to parent or guardian information and even some medical records related to students.

A spokesperson for the university said students who were directly affected by the breach have been contacted by UFV and the school has taken steps to help secure their personal information, through additional details about those efforts were not provided.

The university first informed its students and faculty of the breach Monday and provided updates over the course of the week with a number of security alerts. The administrators also opted to shut down the school’s email system entirely until November 5 in order to prevent the hacker from spreading information.

“UFV takes the responsibility of protecting the privacy of our employees and students very seriously,” a statement from the school said. “We regret that this has occurred and we are working to ensure these systems are secure and the impacted students receive the support and resources they require today and going forward.”

For the time being, details of how the hack occurred remain unclear. The university is investigating the source of the breach along with the Abbotsford police department. Computer forensic experts within the law enforcement office’s major crimes unit are involved in the investigation.

The incident at UFV is the latest in a disturbing trend that has targeted student data left vulnerable by university systems that do not appear to be prepared to defend against breach attempts.

Earlier this year, a study by the Electronic Frontier Foundation found 57 percent of schools have no written policies about student data and found that 80 percent of parents and students are essentially in the dark about how schools are handling technology and information.

In September, a notorious hacking group known as the Dark Overlord attempted to extort schools in the states of Montana and Iowa. The efforts from the group included sending threatening text messages, making bomb threats against schools and claiming to have stolen personal information and voicemails from its victims.