Information about IT systems after critical IT incident

AALBORG OCTOBER 1, 2020

After the hacker attack at Aalborg University, the subsequent analyses have now been completed. There is still no evidence that IT criminals intended to collect personal data but instead had financial blackmailing as a motive. A fast and extensive reaction by the university halted the attack and limited the impact on the university, our staff, and students.

Since Aalborg University on the 4th of August closed the access to all IT systems, the university has carried out in-depth analyses and continuously informed about its results to the Danish Data Protection Agency, the public, and affected users whose data was compromised. The analyses are now complete.

A quick response, along with the advice of top experts concerning the hacker attack, has apparently averted any major damages.

- ”The hacker attack has made us pay even more attention to security. It should not be able to happen again. Therefore, Aalborg University's students and employees have made new and stronger passwords. In addition, technical measures have been implemented, which both ensure better protection against similar attacks in the future and also provide a better opportunity to identify future attempts to compromise Aalborg University's systems.”, says University Director Antonino Castrone.

Personal data collection was not the motive

Aalborg University still has no reason to believe that the purpose of the attack was to collect personal data.  The investigations into the hacker attack show that the attackers have used methods, hacker activities, and tools known from targeted ransomware attacks for financial extortion. Aalborg University has informed those whose personal data information has been compromised, just as the hacker attack has been reported to the Danish Data Protection Agency and reported to the police.

Based on the completed investigation, it can be concluded that the IT criminals have accessed the following areas where personal data have been available:

• Aalborg University’s user database (Active Directory) with all Windows accounts (30,907 accounts). Only general personal data was accessible from the user database. Here you can read about the definition of personal data.
• For 823 employees in Aalborg University's user database (Active Directory), the IT criminals have also copied current and up to 24 previously used password hashes per user account. Here you can read about password hashes.
• 5 system administrators' user accounts and the contents of their associated email accounts. The assessment is that the IT criminals have thus tried to gain knowledge of the university's IT infrastructure. This included access to the system administrators' own and close colleagues' notifications of illness (For example: "I am sick with influenza, so I am not coming to work today").
• An xml file created in 2015 in the Budget System Prophix, which contains general personal data of 28 employees and former employees of Aalborg University.
• An SQL query from spring 2020, in which there was general personal data about 202 employees at Aalborg University consisting of names, initials, work emails, and usernames.
• Finally, the IT criminals have gained access to 10 user accounts. The investigations show that IT criminals have only used these user accounts to access the AAU network.

-”Of course, we take it very seriously when personal data comes into the hands of unauthorized persons, but having said that, we are also very relieved that our processes and monitoring have worked in such a way that we could detect the illicit intrusion early and thus avert a major crash.”, says University Director Antonino Castrone.

Aalborg University considers it relevant to point out that the IT criminals have not gained access to research data at Aalborg University.

Aalborg University has completed the analysis work in relation to the hacker attack, and the university's final conclusion has now been reported to the Danish Data Protection Agency.

For more information see www.its.aau.dk/beredskab

Further information: Chief Advisor Bo Jeppesen, tel. 6140 4061

AALBORG, AUGUST 31, 2020

A quick reaction from Aalborg University (AAU) meant that only a few employees' sensitive personal data was compromised when IT criminals hacked into Aalborg University's IT system. This is the result of the investigation initiated by AAU immediately after the shutdown on August 4th. The compromised data concerns salary information of 28 employees or former employees, and passwords of 15 students and employees. Those affected are now being informed in a letter.

In addition, the university's investigation shows that about 30,000 users are affected by the incident, as the IT criminals have had access to the university's network and user database (Active Directory). The user database primarily shows general personal data, which is publicly available on Aalborg University's website. Additionally, it contains passwords in encrypted form (password hashes) and, for some users, mobile number for multifactor authentication.

Aalborg University is currently notifying everyone with a user profile in the university's user database whose general or sensitive personal data has been compromised.

PERSONAL DATA COLLECTION WAS NOT THE MOTIVE

It has been assessed that the intention of the illicit access was to gain access to the university's other IT systems, as well as to acquire knowledge of the university's IT infrastructure, to be able to blackmail the university with the threat of carrying out a targeted ransomware-attack, concluding that exporting personal data was not the motive behind the attack. This assessment is based on the methods, hacker activities, and tools used by the IT criminals in relation to the attack.

INCREASED SECURITY REQUIREMENTS

- Although personal data in itself does not appear to be the motive behind the attack, we obviously take it very seriously that IT criminals have had access to our network and the personal data of employees and students. We are glad that we discovered the attack this early so that only a few out of many users have had their sensitive personal data compromised. After the attack, we immediately closed access from and to the internet and then ensured that all users changed their password. We have increased monitoring on all systems, and we are proceeding with scheduled security measures, as well as following the controlled plan for a safe reopening of access to the IT systems. Specifically, from now on, both employees and students will meet increased security requirements for e.g. passwords and multifactor when they access and use IT systems at AAU, says University Director Antonio Castrone.

For further information, see en.its.aau.dk/alert

Press Contact: Chief Advisor Bo Jeppesen, tel. 61404061

We are following the plan for reopening access to all systems and services. Before a system/service can be reopened, an extensive check-up procedure needs to be introduced.

Therefore, we have set up a temporary data hotline to ensure that activities, that are very important to AAU the next 14 days, will be prioritized.

The temporary data hotline can be contacted at tel. + 45 9940 7000

The phone is open every weekday from 8-15.30.

The service is temporary, and the hotline will be shut down when the systems operate as usual. 

NOW USERS WITHOUT NEMID, who are not able to meet in person, also CAN CHANGE PASSWORD

We are now ready to help employees and students, who do not have a NemID, and who are not able to meet in person, to change their password.

Please, call ITS Support at + 45 9940 2020. Of course, there is also by this method a user verification demand. ITS Support will guide you through the verification steps.

See addresses and opening hours for ITS Support

USERS WITHOUT NEMID NOW ALSO CAN CHANGE PASSWORD

We are now ready to help employees and students, who do not have a NemID, to change their password.

Please, come to one of ITS’ local service desks in person and bring photo identification (passport) and AAU card. When your ID has been approved, we will help you to change your password.

See addresses and opening hours for ITS service desks

If you are not able to show up at campus at this time in order to change your password, please be patient and wait for further instructions.

In order to find information about the upcoming semester, please visit www.newstudents.aau.dk or contact your study secretary.

YOU CAN NOW CHANGE YOUR PASSWORD WITH NEM-ID

We are in the process of reopening access to AAU's IT systems.

In order to access AAU's IT systems again, you must first change your password to one you have never used before.

You can change your password at nyadgangskode.aau.dk.

If you are physically on campus, your PC will have difficulty connecting to the network, so we recommend that you use your mobile phone.

Since all AAU users have to change their password, you may experience some waiting time on the system. Keep trying until you succeed.

If you are employee at AAU, you must use a VPN connection or be present at the campus to access systems at AAU. Initially you will have access to mail, phones, Office365 and selected administrative systems. Following access to systems will be granted gradually.

If you are a student at AAU, you must change your password and you will have access to mail and Office 365. Educational systems will be accessible as soon as possible.

You can see additional guidance on en.aau.dk, and if you need more help, please contact ITS Support at Tel. +45 9940 2020.

We apologize for the inconvenience and appreciate your patience and understanding.