Sask. Polytechnic says no personal information taken in cyberattack
Incident in October impacted emails, online learning and Sask. Polytechnic's website
Sask. Polytechnic administration says an investigation into a recent cyberattack found that no personal information was taken.
On Oct. 30, the school had a cybersecurity breach started by a malicious email file attachment. Sask. Polytechnic administration said they would not comment on if it was a staff member, student or administrator who opened the attachment.
Sask. Polytechnic's website, email services and online learning were all impacted, said Cheryl Schmitz, CFO and VP of administrative services during a news conference.
"It is a very stressful time for students on top of learning in the COVID-19 pandemic situation and we are making every effort to ensure that our students get the same level of service," Schmitz said.
Schmitz said winter semester graduation is on track to be on time. Registration for continuing education courses was delayed, but those courses do not have specific graduation dates, she said.
Continuing education students are registering by phone while Sask. Polytechnic works on resuming the online component of registration services.
"We understand our students, their parents, our employees were at times frustrated," she said.
We cannot speculate about the intent of the cybersecurity incident. In fact, we may never know.- Cheryl Schmitz
She acknowledged that at the beginning of the incident, staff weren't able to return calls — because phone lines were down — and took a long time to reply to some emails.
"Saskatchewan Polytechnic, as you can appreciate, is a large and complex institution, a provincial institution. Many people have been working very hard to complete restoration to full operations, but this is a complicated and a very time consuming project," she said.
Schmitz said the school is taking a cautious and phased-in approach to restoring services and has been using external cybersecurity experts for support. She said progress has been made and almost all services have been restored.
Police investigation continuing into cyber attack
Schmitz said the Regina Police Service investigation remains open.
"We cannot speculate about the intent of the cybersecurity incident. In fact, we may never know," Schmitz said.
Schmitz said Sask. Polytechnic wouldn't be commenting on the technical aspects of the incident and wouldn't say if there was a ransom demand. She did say, "we did not pay any ransom."
The institution has increased online security for students and employees, including using multi-factor authentication for online services and anti-virus software for employee computers. Schmitz said there is no indication that students' personal computers were impacted.