Data from 1968 to 2020 may have been accessed in cyberattack on B.C. university impacting 200,000

VANCOUVER -- A Metro Vancouver university is warning students and staff that some of their personal data may have been exposed.

Simon Fraser University issued an advisory Tuesday of a cyberattack on one of its servers. The server was accessed back on Feb. 3, and was shut down on Feb. 5.

The school said the hacker or hackers accessed spreadsheet data that contained personal information for "a number of" current and former students. Information on faculty, staff and students who've applied to the school was also accessed.

Approximately 200,000 people may have been impacted, an estimate from SFU suggests. A post on the school's website shows which data categories may have been accessed.

The list includes students who enrolled between 2012 and 2020, students who applied for financial aid between 1988 and 2017, and undergraduate and graduate student honour awards dating back as far as 1968, among other categories. 

As for what that information is, SFU said in a statement that it would vary for each person impacted by the breach.

However, those behind the attack would not have gained access to information including banking details, passwords and social insurance numbers, SFU said.

"For the majority of those impacted, the personal identifiable information is their student/employee ID number and at least one other data element," the statement said.

That extra element could be, for example, information about their admission or academic standing.

The post-secondary institution said risk of identity theft as a result of the breach is low, but anyone impacted should monitor their personal accounts and memberships over the next few months, watching for unusual activity.

"We recognize how frustrating it is for individuals who have had personal data exposed," SFU said, claiming security is a high priority.

"Cyberattack attempts are on the rise with increasingly sophisticated methods to gain entry into IT systems. In response, the university has been steadily increasing the strength of our institutional information security systems and continues to do so."

The school said it will directly notify anyone impacted, provided they have a current email address on file.

Anyone who wants to check whether their data may have been accessed can do so online, if they have an SFU ID and password. 

They can also contact the school's IT services helpdesk at [e-mail] or at 1-778-782-8888.

SFU officials say there will be a full forensic analysis, and the Office of the Information and Privacy Commissioner for B.C. will be involved.

Internal policies will be audited, with possible improvements identified.