Cyberattack on a Chair’s Server: Answers to Frequently Asked Questions

The chair of Economic and Business Education – Learning, Design & Technology was the target of a cyberattack. In the process, unknown actors gained access to the chair’s server. On 17 September, the chair holder received an email in which the attackers threatened to publish data.

The server was shut down after the incident was discovered and was isolated from the remaining (university) cloud system.

The university's crisis management team convened shortly after the attack became known and has been meeting regularly ever since. The relevant departments at the University of Mannheim (University IT, Chief Information Officer, Department of Information Security, and Data Protection Team) are handling the incident. Moreover, the appropriate authorities outside of the university (State Office of Criminal Investigations (LKA), Baden-Württemberg Cybersecurity Agency (CSBW), data protection officer, and State Commissioner for Data Protection and Freedom of Information (LfDI)) were involved.

The final technical and forensic investigation into the attack, conducted in close cooperation with the relevant investigative authorities and external agencies, is still ongoing. We therefore currently cannot provide reliable information about when the actors gained unauthorized access, what kind of data was affected, or to what extent data was obtained by third parties.

Initial findings point to the following groups of people and data that may be affected:

• Students who have completed coursework or examinations at the Chair of Economic and Business Education – Learning, Design & Technology:
  This may affect coursework and examinations, such as term papers, seminar papers, and final theses, as well as the corresponding grade lists. At this point, it is not yet clear which data was copied by the attackers and whether that data is being misused.
  Ongoing studies and examinations are not affected. The University of Mannheim still holds the complete sets of data affected. The examination processes have been completed, and the results have been entered into the campus management system Portal². Any manipulation of examination results can be ruled out.
• Employees of the Chair of Economic and Business Education – Learning, Design & Technology:
  Data that may be affected includes personnel data of the chair’s employees that is required in the hiring process, such as application documents and request forms for hiring or contract renewal, as well as data required for the reimbursement of expenses related to business trips. 
• Researchers and institutions that collaborate or have collaborated with the chair:
  Data that may be affected includes data of collaborating institutions and researchers processed in connection with the chair holder's official duties, procurement activities, or publications.

In all cases, it is still unclear whether any data was compromised and, if so, what data, or whether any other individuals or groups are affected. As soon as more detailed information becomes available, affected individuals and institutions will be informed directly wherever possible. There is no information available on the exact number of people affected, yet.

At this point, there is no evidence to suggest that the attackers have published the data sets they obtained.

As soon as the incident came to light, the State Office of Criminal Investigations (LKA) Baden-Württemberg has been involved.

1. Be vigilant: Before opening incoming emails, check them for abnormalities (tampering with the sender’s address, spelling errors, etc.). In particular, please exercise caution and verify the authenticity of any messages claiming to come from the Chair of Economic and Business Education – Learning, Design & Technology.
2. Do not disclose information until you have thoroughly confirmed the intended use: For example, University of Mannheim staff members will never ask for login data. If you receive a request for sensitive data in the name of the Chair of Economic and Business Education – Learning, Design & Technology, please verify, for example, by phone, whether the request actually came from the chair or from the University of Mannheim.
3. Check the transactions on your bank account: In case you detect any unauthorized or unexpected charges, please contact the University of Mannheim and your bank immediately.
4. As a precautionary measure, please change all passwords you use in connection with the university.

For more recommendations and safety measures, visit https://www.bsi.bund.de.

Please send an e-mail to rueckfragen-informationssicherheituni-mannheim.de.