Advanced Procurement for Universities and Colleges (APUC) says attackers gained unauthorized access to historical data in a cyberattack earlier this month.
The Scottish education procurement body said it immediately contained the mid-July intrusion and was investigating claims that some of the data had been stolen.
"We recently discovered suspicious activity on our IT systems involving unauthorized access to certain historic data," an APUC spokesperson told The Register. "We took immediate action to contain the incident and are investigating the scope of it, working alongside external technical specialists. There has been no operational disruption to our day-to-day activities.
"We are aware that the group responsible for the unauthorized access has claimed to have taken some historic data from our systems. We are investigating this as a matter of priority. We have notified the relevant authorities and will continue to cooperate with them."
APUC is Scotland's procurement center of expertise for universities and colleges, and one of eight members of UK Universities Purchasing Consortia (UKUPC).
These organizations negotiate agreements with approved suppliers, allowing member institutions to buy goods and services without running a separate procurement exercise each time.
APUC arranges these deals as Framework Agreements – pre-vetted terms under which Scottish universities and colleges can place orders with approved suppliers.
MORE CONTEXT
The organization lists hundreds of Framework Agreements covering contracts collectively worth hundreds of millions of pounds.
APUC confirmed the attack after sources approached The Register with information about the incident.
Those sources claimed APUC received an extortion demand from the criminals behind the intrusion, although we have not independently confirmed that detail.
The Register understands that the crooks claimed to have stolen APUC data dating back 20 years, and gained admin access through an employee account.
We asked APUC about these claims, whether ransomware was involved, and whether it could identify any inaccuracies in the information we received. The spokesperson did not address those questions.
At the time of writing, APUC did not appear on any of the major ransomware or extortion groups' data leak sites. ®
