Cyber Incident Victim: University of Alberta
Date:
Nov 2016
Location:
Canada
Summary
A malware attack compromised over 300 computers at the University of Alberta, exposing personal data of more than 3,000 students and faculty members across multiple campus facilities. The institution's IT security team detected and contained the malicious software promptly, but full campus notification was delayed due to an ongoing police investigation that resulted in criminal charges against a 19-year-old student allegedly responsible for the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 22, 2016, the University of Alberta's Information Services and Technology unit detected malware installed on 304 university computers located in 20 classrooms and labs across three campus buildings: the Library Knowledge Commons, Computing Science Centre, and Centennial Centre for Interdisciplinary Science. The institution immediately implemented containment measures to mitigate the security risk. The malware exposure potentially compromised personal information belonging to over 3,000 students and faculty members who had used the affected systems. A criminal investigation ensued, resulting in charges against a 19-year-old male student in connection with the incident. Due to the ongoing police probe, the university delayed campus-wide notification of the breach until January 5, 2017, when it publicly disclosed details through a website statement by Chief Information Security Officer Gordie Mah.
The security breach specifically impacted academic computing facilities used by students and staff for research and coursework. While the malware created significant data exposure risks, the university's technical response neutralized the threat upon detection. The delayed disclosure timeline—spanning six weeks from initial discovery to public notification—was directly attributed to law enforcement involvement in the criminal case against the accused student. No evidence of actual data theft or misuse was confirmed in the available reports. The university's January 5 statement constituted the first comprehensive disclosure to the campus community regarding the scale of compromised systems and the potential consequences for affected individuals.