Kauno technologijos universitetas

Summary

A cyberattack targeting Kauno technologijos universitetas disrupted access to numerous information systems, leading to unauthorized access of employee personal data including names, national identification numbers, addresses, phone numbers, email addresses, and vehicle license plates. While publicly circulated documents allegedly belonging to university community members were not stored in the compromised systems, they may have originated from affected workstations. The breach potentially enables malicious actors to impersonate individuals or compromise their professional and personal accounts. The institution initiated system recovery efforts, notified law enforcement and data protection authorities, and is implementing enhanced security measures while continuing its investigation into the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 8, 2023, Kauno technologijos universitetas (KTU) experienced a cyberattack targeting its information systems, disrupting access to numerous university services. The attack prompted an immediate internal investigation and system recovery efforts, with notifications made to law enforcement and regulatory authorities. Forensic analysis confirmed unauthorized access to personal data and other information within compromised systems. Specifically, attackers obtained employee data including full names, personal identification numbers, residential addresses, phone numbers, email addresses, and vehicle license plate information. While documents belonging to university community members surfaced publicly, KTU clarified these files were not stored in the systems directly impacted by the attack, suggesting potential compromise through individual workstations. The university acknowledged that threat actors could exploit the stolen data for identity theft, unauthorized account takeovers, or fraudulent activities conducted under victims' identities without consent.

KTU initiated containment measures including password resets for university systems and urged community members to scrutinize emails for phishing attempts while avoiding suspicious links or unsolicited authentication requests. The institution recommended changing personal passwords reused across KTU systems and adopting multi-factor authentication where possible. Ongoing collaboration with the State Data Protection Inspectorate and police continued as the university worked to fully restore affected systems. Additional security controls were implemented during recovery operations, with impacted individuals directed to contact designated data protection officers or external privacy consultants for specific inquiries about compromised information. System anomalies observed by users were to be reported immediately to a dedicated university email address while forensic investigations remained active to determine the full scope of attacker activities and persistence mechanisms.

Sources

Sources available to members: 1 source.