Lancaster University is the latest educational institution to be hacked, with data related to as many as 12,500 students stolen in the process.

The hack, described as a “sophisticated and malicious” by the BBC involved a phishing campaign that saw bogus invoices sent to undergraduate applicants. While claiming that only a small number of records were stolen, the university admitted that undergraduate applicant records for the years 2019 and 2020 had been accessed, along with the data of some current students.

The data stolen is said to include names, addresses, phone numbers and emails. The U.K. National Crime Authority National Cyber Crime Unit has launched an investigation into the hack.

Hacks of this sort are a dime a dozen, but this is a reminder that government-funded organizations need to do more to protect their data and educate their employees and, in this case, students.

“While this reported attack certainly seems to be a targeted one, it is by no means sophisticated,” Richard Cassidy, senior director of security strategy at security management firm Exabeam Inc., told SiliconANGLE. “The techniques used are a tried and tested favorite of almost all cybercriminal and nation-state groups.”

The challenge here, he said, is educating people how to fight against phishing attacks, in particular to report any suspicious communications if they have any doubts.

“Students need to be suspicious of any email or communication, including text messages, social media posts and ads, with urgent requests for personal financial information,” said John Ford, chief information security officer at business software firm ConnectWise LLC. “Phishers typically include upsetting or exciting but false statements to get people to hand over their usernames, passwords, credit card numbers, social security numbers, date of birth and other personal information.”

That’s why, he added, people should type the web address themselves instead of clicking on displayed links.

Photo: Geograph