Universidade Católica Portuguesa

Universidade Católica Portuguesa, also known as UCP, is a private university headquartered in Portugal. The institution provides higher education and academic services, operating at least one campus in Porto where it delivers educational programs and maintains digital infrastructure for its students and staff. As a private entity, its operational and regulatory frameworks differ from those of public universities in the country, influencing its incident response protocols and external reporting obligations.

In late November 2022, UCP’s Porto campus experienced a significant cyberattack that directly disrupted core academic services and digital tools used by the university community. The incident forced a suspension of these tools, compelling students and staff to rely on external file-sharing platforms to continue essential operations during the outage. Recovery was gradual, involving off-site mandatory password changes because on-campus Wi-Fi access was disabled. While the attack caused substantial operational interruption, UCP reported that no compromise of personal data was confirmed. Following the incident, the university formally notified national data protection authorities about the breach. However, because UCP is a private institution, it did not report the event to Portugal’s national cybersecurity center, highlighting a key distinction in its regulatory reporting responsibilities compared to public sector bodies. The response underscored the institution’s reliance on its internal IT recovery processes and the immediate practical adaptations made by its community to maintain academic continuity.