Université de Sherbrooke

Summary

The Université de Sherbrooke experienced a cyberattack impacting two research laboratories, resulting in compromised data from these specific units. The institution confirmed the incident did not involve ransomware and emphasized the breach was highly localized, with no broader disruption to university operations or digital platforms. Students and staff retained full access to email and other systems throughout the event. A crisis team was activated to manage the response, and an investigation into the incident remains ongoing.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 1, 2023, the Université de Sherbrooke (UdeS) activated a crisis management team following the discovery of a cybersecurity incident. The attack targeted two specific research laboratories within the university infrastructure, compromising certain data assets. University officials confirmed the incident did not involve ransomware and emphasized the highly localized nature of the breach, with no broader infiltration of primary academic or administrative systems. Digital platforms including student and employee email accounts remained fully accessible throughout the incident. Initial investigations determined the operational impact was minimal, with no disruption to academic activities or university services. The breach was contained exclusively to the affected research laboratories, preventing lateral movement across UdeS networks. University administration promptly notified relevant stakeholders through email communications and public statements while maintaining academic operations.

Forensic analysis confirmed unauthorized access to research data within the compromised laboratories, though the exact scope and sensitivity of exfiltrated material remained under investigation. Technical teams isolated affected systems to prevent further unauthorized access while preserving evidence for analysis. The university did not disclose specific intrusion vectors or attacker attribution in its initial communications. No evidence indicated compromise of financial systems, personnel records, or student information beyond the two identified research units. Response efforts focused on securing compromised assets, assessing data loss, and restoring unaffected systems to verified operational standards. The incident investigation remained active with dedicated cybersecurity personnel analyzing attack patterns and system vulnerabilities. University officials maintained public transparency regarding the containment status while refraining from speculative commentary about potential threat actors or motives.

Sources

Sources available to members: 1 source.