Newcastle University admits data breach after ExfilSquad hacking claim

Hackers exploited flaw in admissions system to steal personal data

Newcastle University has confirmed a data breach after the cybercrime group ExfilSquad claimed it had stolen about 440,000 records from the institution

The university said a configuration flaw in a connection to one of its admissions systems had enabled unauthorised access to some personal information, including names, email addresses, telephone numbers and postal addresses.

The institution was alerted to possible unauthorised access on 27 July and has since corrected the flaw. The university said there was no evidence that its wider systems had been compromised, or that ransomware or malware had been deployed.

The university has not identified the affected system or explained precisely how it was misconfigured. Specialist security partners are carrying out further forensic investigations.

The UK's Information Commissioner's Office (ICO) has been notified of the incident.

ExfilSquad claims stealing 440,000 records

ExfilSquad has listed Newcastle University on its leak site and claimed that the stolen material contains about 440,000 records, including applicant and student contact details and other personally identifiable information.

But there is a significant difference between the group's claims and the university's findings.

While ExfilSquad alleges that admissions information and "significant PII" were stolen, Newcastle University said its investigation had found no evidence that admissions records or exam results were exposed.

Phishing risk

The university said the breach did not compromise passwords, financial details, admissions records or exam results. However, exposed contact details could still be valuable to criminals seeking to carry out phishing or impersonation scams.

Names, email addresses, telephone numbers and postal addresses could allow attackers to make fraudulent calls, emails or text messages appear more credible.

Newcastle University said people affected by the breach do not currently need to take any action, but urged students, applicants and others who had provided their contact details to remain alert.

People receiving unexpected requests for credentials or money should verify them independently rather than clicking links or opening attachments in suspicious messages.

The UK's National Cyber Security Centre also advises people to be cautious of phishing attempts and report suspicious activity.

ExfilSquad targets organisations worldwide

ExfilSquad is an extortion-focused cybercrime group that attempts to pressure organisations into paying by threatening to publish stolen information.

Its leak site warns victims that once their data is released, it will remain publicly available and argues that paying a ransom is cheaper than dealing with the consequences of a leak.

The group has claimed attacks against a number of organisations in recent weeks, including Allstate, District of Columbia Public Schools and Wesco International, a Pittsburgh-based supply-chain company.

On 26 July, the group posted claims involving 15 organisations in a single day, including the municipal governments of Atlanta and Houston. It has also claimed to have stolen data from the UK Department for Education and Police National Legal Database.

ExfilSquad's emergence comes as fewer organisations are choosing to pay cyber extortion demands. According to ransomware response firm Coveware, only 15% of victims it investigated between April and June paid a ransom solely because their data had been stolen.

That was down from 29% in the previous quarter and the lowest level recorded by the firm.