University of Warwick

Summary

A UK university experienced a cybersecurity breach when an employee inadvertently installed malware, enabling hackers to access personal information of students, staff, and research volunteers. The institution failed to notify affected individuals due to inadequate data protection measures that prevented identification of the compromised data, compounded by governance failures identified in a regulatory audit. Leadership resisted voluntary oversight and lacked specialized expertise, resulting in the dissolution of its data protection group following regulatory criticism of systemic deficiencies in security protocols and training.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In July 2019, Warwick University experienced a cybersecurity breach when an employee inadvertently installed malware on its administrative network, enabling attackers to access personal information belonging to students, staff, and research volunteers. The malware facilitated unauthorized extraction of data stored on the compromised systems. The university’s inability to determine precisely which data had been exfiltrated compounded the incident, as inadequate data protection practices prevented comprehensive forensic analysis. Registrar and executive lead for data protection Rachel Sandby-Thomas opted against notifying affected individuals about the breach, despite obligations potentially arising under the GDPR. The university’s failure to disclose the incident’s scope or confirm whether it reported the breach to the UK Information Commissioner’s Office (ICO) drew criticism, particularly given the sensitivity of the compromised administrative network.

A March 2020 ICO voluntary audit revealed systemic deficiencies in Warwick University’s data protection framework, identifying failures in governance, accountability, security controls, and training programs. The audit assigned a "very limited" assurance rating to staff awareness and training initiatives. Following ICO recommendations that Sandby-Thomas lacked the requisite expertise for her role, the university disbanded the Data Protection Privacy Group (DPPG) she chaired. Internal communications obtained by media outlets indicated Sandby-Thomas initially attempted to obstruct the voluntary audit, relenting only after being informed the alternative would involve a compulsory investigation. The breach and subsequent handling eroded institutional credibility, with cybersecurity experts emphasizing that transparency following such incidents typically mitigates reputational harm more effectively than concealment attempts.

Sources

Sources available to members: 1 source.