Shutterstock/NicoElNino
“Friday morning, June 23, we received information that the threat actors behind this incident claimed to have acquired some data, which might include sensitive or personally identifiable information of some current and former employees and students,” said Interim President Gina Oglesbee in a published statement. “In collaboration with law enforcement and external cybersecurity experts, we are in the process of evaluating this information and determining who might be affected.”
The school has been assessing and recovering systems since June 12, after discovering the cyber incident.
SFA officials had taken its systems offline and severed its Internet connection as preventive measures, according the Online Services Outage webpage, where several updates are posted.
The Daily Sentinel in Nacogdoches reported June 23 that it had received emails from a hacker group called Rhysida, which included some files claimed to be from the hack. The ransomware group is new on the cyber scene, according to a SentinelOne website explainer, but wasn’t named by SFA officials.
“These are criminals, and we aren’t interested in engaging them inappropriately,” Graham Garner, SFA’s chief marketing communications officer, told the news outlet.
SFA, which recently had been adopted into the University of Texas System, also said its IT team was working with UT System colleagues.
Email, courseware and university websites have been restored with some caveats. Email was accessible only on campus or via VPN access, but mobile email hadn’t been restored as of midweek. Payroll deadlines are intact, and payment processing for students is available.
