King's College London

Summary

Kings College London responded to suspected malicious activity by resetting passwords for accounts believed to be at imminent risk of compromise, likely due to a brute-force or dictionary attack. This action caused temporary access disruptions to email and other services for some users, though no actual data breach or damage was reported. The institution's security teams implemented protective measures and advised affected individuals to adopt multi-factor authentication and standardized systems to enhance account security.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early April 2019, King's College London (KCL) detected malicious activity targeting its account systems, prompting immediate security interventions. Between April 8-10, the university's IT teams identified signs of a potential brute-force or dictionary attack aimed at compromising user credentials. Technical staff proactively reset passwords for accounts suspected of imminent compromise, leading to access disruptions for affected students and staff. Some users experienced difficulties accessing their university email accounts through non-standard clients as security protocols were reinforced. KCL circulated an internal memo acknowledging these protective measures, stating the actions were taken because accounts were "about to be compromised." The institution emphasized there was no evidence of an actual data breach, unauthorized access, or loss resulting from the incident at that stage. Detection efforts focused on anomalous login patterns indicative of systematic credential-guessing attempts.

The university's response centered on containment through forced password resets and hardening of authentication mechanisms. IT administrators advised impacted individuals to adopt multi-factor authentication and use KCL's approved operating environment rather than third-party setups. While the incident caused temporary inconvenience through account lockouts and credential changes, no operational damage or data exfiltration was confirmed. KCL declined to provide additional public statements when queried about technical specifics, attacker origins, or the exact number of targeted accounts. Security teams maintained vigilance for follow-on attacks but observed no escalation beyond the initial credential-targeting activity. The measures successfully prevented confirmed account takeovers, with no subsequent disclosures of compromised personal or institutional data linked to this event.

Sources

Sources available to members: 1 source.