Cyber Incident Victim: Universidad de Castilla-La Mancha
Date:
Apr 2021
Location:
Spain
Summary
The University of Castilla-La Mancha experienced a ransomware attack targeting its technological infrastructure, prompting the institution to report the incident to Spain's National Cryptological Center Computer Emergency Response Team. Public notifications via social media clarified that individual university community devices were unaffected, while the institution's IT teams prioritized restoring digital services critical to teaching operations. Despite recovery efforts, the university's main website remained inaccessible following the attack. No details regarding the specific ransomware variant or potential ransom demands were disclosed by authorities or the university.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 19, 2021, the University of Castilla-La Mancha (UCLM) experienced a ransomware attack targeting its technological infrastructure. The university promptly reported the incident to Spain’s National Cryptological Center Computer Emergency Response Team (CNN-CERT), the national authority responsible for cybersecurity in public administrations and strategic entities. UCLM publicly acknowledged the attack through official communications on its Facebook and Twitter accounts, as well as via the news agency efe. In a tweet dated April 20, 2021, the university clarified that the attack specifically impacted its core technological systems rather than the individual devices of students, faculty, or staff. This distinction aimed to reassure the university community that personal data on endpoint devices might not have been directly compromised, though the institution did not explicitly confirm this.
The university’s IT department, UCLMtic, immediately initiated recovery efforts with a stated priority on restoring digital services critical to teaching activities. Despite these efforts, the university’s main website remained inaccessible as of the morning following the attack announcement. No technical details regarding the ransomware variant, attack vector, or data exfiltration were disclosed publicly. Similarly, UCLM did not reveal whether the attackers demanded a ransom or if any negotiations occurred. The incident disrupted digital operations across the institution, though the full scope of affected systems beyond the website outage was not detailed in available communications. Recovery timelines and the operational status of non-teaching-related systems (such as research databases or administrative platforms) were also unspecified in the immediate aftermath.