Cyber Incident Victim: SUNY Erie Community College
Date:
Jul 2020
Location:
United States of America
Summary
A malware attack disabled approximately 50 staff computers and the website at SUNY Erie Community College, disrupting operations across all three campuses. The institution confirmed no ransom demand was made and stated student data remained secure due to unaffected backups. The dormant malware, activated after an unresolved prior technical issue, exclusively targeted on-campus Windows staff devices. Law enforcement and emergency management agencies were engaged in the investigation, while campuses restricted access to essential personnel. Recovery efforts, supported by State University of New York and University at Buffalo resources, aimed to restore full functionality shortly. The incident mirrored a prior ransomware attack on a local medical center that also relied on backups to avoid paying extortion demands.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 22, 2020, SUNY Erie Community College experienced a malware attack that disabled approximately 50 Windows-based staff computers across its three campuses and rendered the college website inaccessible. Interim President Bill D. Reuter stated the attack was discovered in the early morning hours of Wednesday, July 23, with no ransom demand made by the perpetrators. The malware had reportedly been dormant within the system for an extended period prior to activation, following an unresolved technical issue the previous evening that IT staff believed they had addressed. The attack exclusively affected staff computers connected to the on-campus network, with no evidence of compromise to cloud-based systems or off-campus infrastructure. Upon arriving at his office at 6:45 a.m., Reuter initiated emergency protocols that included contacting Erie County Central Police Services and Emergency Management, while an undisclosed additional law enforcement agency joined the investigation.
The college restricted campus access to security, maintenance, and IT personnel during the forensic examination to determine the malware's origin. Investigators confirmed student data remained secure through unaffected server backups and cloud storage systems, with no indication of unauthorized access or data loss. Reuter expressed cautious optimism about restoring full operations by Thursday afternoon, citing assistance from SUNY's central office and the University at Buffalo. The incident mirrored the 2017 ransomware attack on Erie County Medical Center in its early-morning timing, though unlike ECMC's six-week recovery involving tape backups, ECC's containment focused on isolating compromised endpoints. College officials maintained public assurance regarding data integrity while continuing system diagnostics, emphasizing the localized impact limited to staff workstations rather than core academic or administrative platforms.