University of the West of Scotland data auctioned by Rhysida ransomware gang

The University of the West of Scotland said it was the victim of a cyberattack that began in early July 2023 and affected a number of its digital systems, including its public facing website, which was down for several days.

Later that month the Rhysida ransomware group listed the university on its dark web leak site and put the stolen material up for auction to a single buyer. The group sought 20 bitcoin, worth roughly 450,000 pounds at the time. Rhysida published samples it said included staff personal details such as bank information and National Insurance numbers, along with internal university documents.

UWS confirmed it had been the victim of a cybercrime that affected a number of digital systems and that some staff data had been accessed. It said it was working with Police Scotland, the National Cyber Security Centre and the Scottish Government, had reported the matter to the Information Commissioner's Office, and was supporting affected staff directly.

Police Scotland confirmed that inquiries were under way into the incident, reported in Paisley. Tech Monitor noted that the decision to auction the material suggested the university had not paid, consistent with National Cyber Security Centre guidance against ransom payments. Rhysida was first spotted in May 2023, when it attacked the Chilean Army, and had since hit organizations across the public and private sectors around the world.