University of Texas at San Antonio

Summary

The University of Texas at San Antonio detected attempted unauthorized activity at the edge of its network and took several technology systems offline to contain the threat. As a precaution, the start of the academic term was postponed and registration and payment deadlines were extended while teams worked to restore services. Officials reported that the response was effective and no evidence of data access or exfiltration has been found, with the investigation continuing in coordination with expert partners.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 17 2026 university leaders at the University of Texas at San Antonio announced that they had detected “attempted unauthorized activity” at the edge of the institution’s network before it reached core systems. The detection occurred over the weekend preceding the scheduled start of the fall semester, which was set for Wednesday August 19. In response, officials proactively took several technology systems and services offline, including email, phone services, online registration, tuition payment platforms and dining service accounts, to evaluate the environment and reinforce safeguards. President Taylor Eighmy communicated to the campus community that the start of classes would be postponed by three days, moving the first day of instruction to Monday August 24 to give technology teams time to restore services carefully. The university also extended registration and payment deadlines, moving the student payment deadline to 5 p.m. Friday August 21 and pushing waitlist registration deadlines to 8 a.m. Wednesday August 26.

The system outage disrupted a wide range of campus functions. Students reported being unable to log into their university accounts, access class schedules, syllabi or course materials, and many were unable to make tuition payments or update their registration. Parents voiced frustration on social media and university forums, noting that phone lines were down and that dining services could not process Dining Dollars or Meal Trades at campus locations. Faculty members, including adjunct professor Eric Alva, described being unable to access teaching resources or communicate with students as the semester’s start approached. The university’s phone systems were specifically noted as unavailable in a midday update on August 17, with expectations of later restoration that day. Officials also announced that the password reset system was experiencing delays, preventing users from updating their passphrases despite instructions to do so.

In response to the incident, University Technology Solutions, working with external expert partners, contained the activity at the network perimeter and began a thorough evaluation of the technology environment. Statements from Andrea Marks, chief operating officer, and Michael Schnabel, chief technology officer, indicated that the response had been effective and that, as of the latest updates, there was no evidence that any university data had been accessed or exfiltrated. The university asked students and faculty to update their passwords once the reset system was operational, and it continued to provide updates through email, online portals and social media channels. Investigations into the source of the unauthorized activity remained ongoing, with officials noting that they had identified the source but would not disclose further details while the inquiry proceeded in coordination with expert partners. The incident did not affect the university’s medical branch, UT Health San Antonio, which remained operational.

This event added to a pattern of cybersecurity challenges facing higher education institutions, following breaches at Princeton, New York and Columbia Universities the previous year and a widespread compromise of the Canvas learning management system earlier in 2026 that forced many colleges to delay final exams. Ransomware attacks on higher education rose more than eight percent in the first quarter of 2026 compared to the same period in 2025, underscoring the growing threat landscape. University leaders emphasized that the precautionary shutdown, while disruptive, was intended to protect the integrity of systems that support registration, financial aid, research and daily campus operations as the new academic year began. The university stated that, aside from the three‑day delay, the semester would proceed as scheduled with necessary academic adjustments made within the existing calendar.

Sources

Sources available to members: 4 sources.