Charles University in Prague says it has spent the past few days dealing with a serious cybersecurity incident. One web application was compromised, and an attacker then gained unauthorised access to data in the central Student Information System, known as SIS.

The technical investigation so far has confirmed, the university says, that the attacker obtained and downloaded part of the records held in SIS, including personal data. The school says it has not yet established the exact number of people affected, the full scope of the information taken, or whether it has been misused further.

The university reported the incident to NÚKIB, the national cyber and information security agency, and filed a criminal complaint against an unknown perpetrator. Prague police spokesman Richard Hrdina told the ČTK news agency on 13 November that police had received a report related to the case that day and were investigating it. NÚKIB spokesman Jakub Neščivera also told ČTK that the agency is dealing with the attack on the university, but cannot give further details because of the investigation and a legal duty of confidentiality.

As soon as it discovered the incident, the university took the compromised application offline and secured the related access. Its cybersecurity and IT teams, working with the faculties, are still assessing the scale and the possible effects.

Users of the central authentication service, CAS, were asked in an email sent to students to change their password within ten days of receiving the message. The university describes the step as a precaution, meant to strengthen the protection of accounts and of access to the school’s systems. Seznam Zprávy and ČTK say they have seen the email.

The school says it will announce only confirmed findings, taking the investigation and the security of the fix into account. The sources consulted do not give a number of people affected.

The photograph shows the Karolinum, the historic seat of Charles University in central Prague. It is not the system that was attacked and it does not show student records. Credit: Stanislav Dusík, Wikimedia Commons, CC BY-SA 4.0.

Source: Někdo se naboural do systému Univerzity Karlovy, stáhl část údajů studentů, Seznam Zprávy.