Cyber Incident Victim: Université de Neuchâtel
Date:
Feb 2022
Location:
Switzerland
Summary
The Université de Neuchâtel experienced a cyberattack prompting an IT services shutdown to contain the incident. Researchers received messages indicating data encryption, suggesting possible ransomware involvement, though no explicit ransom demands were confirmed at the time. The disruption occurred near the semester start, hindering academic preparations and access to online resources, but critical research equipment remained unaffected. Classes proceeded as planned using external systems not impacted by the attack, ensuring minimal disruption to the academic calendar.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Université de Neuchâtel experienced a disruptive cyberattack beginning on February 17, 2022, with initial signs detected around 23:00 that evening. The university's IT services were intentionally shut down as a containment measure, causing widespread operational disruptions. University spokesperson Nando Luginbühl confirmed the likelihood of malicious actors being responsible, though the specific attack vector remained undetermined at the time of reporting. Evidence suggested potential ransomware involvement, as multiple researchers received external messages indicating their data had been encrypted—a pattern consistent with ransom-driven attacks observed in other recent incidents. The university acknowledged these encryption notifications but reported no formal ransom demands had been received by February 18.
The timing severely impacted academic preparations four days before the February 21 semester start, hindering faculty efforts to update course materials and students' ability to access schedules or communicate via institutional email. Despite these challenges, critical research infrastructure in physics, biology, and computer science institutes was confirmed unaffected, according to Faculty of Science Dean Adrian Bangerter. University personnel implemented coordinated measures across departments to manually distribute essential semester information to students. External online learning platforms remained operational, preserving hybrid teaching capabilities. While researchers expressed concerns about potential data compromise, university officials stated they lacked sufficient information to assess damages as of February 18. Restoration efforts continued without a projected resolution timeline, with all technical teams engaged in containment and recovery operations.