Ransomware Threat: Steps to Protect your Information

UAlbany’s systems were targeted by an EternalBlue attack from an overseas source. Fortunately, no personally identifiable information (PII) was involved, nor was any data taken from the University.

ALBANY, N.Y. (Oct. 13, 2017) -- For cybercriminals, Ransomware attacks have become the method of choice for generating income in 2017. The plan is simple and effective: lock users out of a computer system, hijack the data, and only release the information once a ransom has been paid. Of course, paying ‘the ransom’ is no guarantee victims will actually recover their data.

In May of 2017, more than 300,000 computers worldwide were infected with the "WannaCry" virus, a Ransomware attack that exploited a vulnerability in the Microsoft Windows operating system to encrypt data and demand ransom payments to unlock the information. The attack crippled systems in at least 150 countries, costing upward of $4 billion according to some estimates.

Among the top targets of Ransomware attacks are hospitals, academic institutions, and Fortune 500 companies.

On Saturday, Oct. 7, it was the University at Albany’s turn in the crosshairs. UAlbany’s systems were targeted by an EternalBlue attack from an overseas source (the WannaCry ransomeware often uses EternalBlue as its initial attack). Fortunately, no personally identifiable information (PII) was involved, nor was any data taken from the University.

“The University at Albany is fortunate to have personnel who take their responsibilities very seriously. I would like to thank Chief Information Security Officer Marty Manjak and his team for their vigilance,” said Simeon Ananou, vice president of Information Technology Services and UAlbany's chief information officer. “Because of their expertise and quick action, we were able to minimize the impact of what could have been a very serious attack.”

At present, it appears that 16 University systems were compromised between noon and 1 p.m., including 14 workstations in total, located on the Downtown Campus, the Health Sciences Campus, in the College of Arts and Sciences, the Office of the Provost, facilities management, as well as two library servers.

UAlbany’s information security personnel responded quickly to the attack by quarantining the compromised computers, preventing the spread to other computers and systems within the University’s domain. No critical systems were exposed during the attack and affected data is in the process of being recovered. An analysis of the attack is also underway to determine what made the attack possible, how much data was impacted, and how similar attacks can be prevented in the future.

In the interim, Information Technology Services is providing guidance on what UAlbany computer users can do to protect their data:

1. Turn your computer off at the end of the day to ensure the latest patches are installed
2. Backup your data by saving information on network drives
3. Don’t click on suspicious emails or pop-ups

Your data may or may not be able to be recovered, but you can limit the risk and damage caused by any future attacks.

“October is National Cyber Security Awareness Month,” said Ananou, “and information security is a collective responsibility. Every member of the campus community plays a significant role in protecting the University’s electronic resources and information.”

For more news, subscribe to UAlbany's RSS headline feeds