'It’s a little nerve-racking': U of G begins notifying individuals impacted by cyber incident

Months after an IT incident at the University of Guelph, the institution said it has begun notifying people “whose personal information may have been affected.”

The IT systems incident was first reported on Sept. 11 – just days into the start of the autumn semester.

On April 5, the university provided the update that it has begun contacting individuals who may have been affected to provide further information and recommendations on next steps.

“Our analysis indicates there was no unauthorized access to major University financial systems or enterprise databases,” the U of G said in the update.

The university said it undertook a thorough investigation that identified individuals whose personal information and/or university email accounts may have been accessed.

David Jao, a member of the Cybersecurity and Privacy Institute at the University of Waterloo, says efforts to reach out to people who have been affected should have started sooner.

"Seven months is plenty of time to make use of the information that anyone could have gotten from such an attack,” he told CTV News. “The overall response could have been a little bit better, especially in terms of the transparency and the timeline."

According to the university, unauthorized access was limited to certain email accounts and individual files stored on computer workstations in Human Resources, a file share used by the Ontario Veterinary College and a backup server used by OpenEd.

The post continues: “Immediately upon discovering the incident, the University took steps to contain any unauthorized access and secure its systems. This included a number of precautionary measures, including taking certain systems offline and communicating with our University community about the incident. The University also engaged a team of external experts to assist with containment efforts and to conduct an investigation into the incident.”

Jao says while incidents like this can be hard to handle, a quick response is the best form of action to minimize the damage for those involved.

“Normally, you know, you'd like to get out in front of this within one or two months just because the damage could be already done."

CTV News reached out to the University of Guelph to comment on why it has taken seven months to contact individuals whose personal information may have been accessed. A spokesperson said no one was available, referring instead to the information on the website which says in part: “The nature of the compromise required a manual review of the potentially compromised data by the University which concluded in March 2023… the University took steps… including taking certain systems offline and communicating with our University community about the incident.”

The university said it is continuing to work with law enforcement, government and regulatory bodies to address this incident.

Previously, CTV News Kitchener reported the Office of the Information and Privacy Commissioner of Ontario was involved in the investigation.

REACTION FROM STUDENTS

In the weeks following the cyber incident, students voiced their concerns over the lack of transparency from the university.

Third-year software engineering student, Ayden Panhuyzen, described the lack of transparency as being hypocritical when he spoke to CTV News in October.

“You can even see our own professors doing interviews with news, talking about other companies that have been breached and how there's such a need to be transparent, but [we're] not getting that here definitely,” Panhuyzen said in terms of receiving little information.

At the time, he, along with thousands of students received, “almost 10 emails or something about it,” he said. Yet none of the emails explained what happened.

Today, some students say the recent update is too little too late.

“It's a little nerve racking knowing that people might have had access to all of the payment information, it’s a little scary,” said fifth-year student Zoe Hagerman. “I don’t think I was personally impacted but the fact that it took so long is kind of scary.”

Students continue to say there has been a lack of transparency and information from the school on what actually happened.

“Especially because it is a university and they have all your financial information and pretty much everything about you, it was kind of scary,” explained Hagerman. “To not have any information about it at all was really worrying."