Laurentian University admits personal data was stolen as part of cyber incident

More than two weeks after it happened, Laurentian University is starting to release details about the cyber incident that has paralyzed the institution’s IT systems.

In a news release Wednesday, LU said personal information was stolen from students and personnnel at the Northern Ontario School of Medicine and the Living with Lakes Centre/Co-operative Freshwater Ecology Unit.

“Laurentian University confirms a limited data breach resulting from a broader cyber incident that came to the University’s attention on Feb. 18,” LU said.

Affected by the data theft are:

• Employees (including student employees) of the Living with Lakes Centre / Co-operative Freshwater Ecology Unit hired since 2022.
• Employees affiliated with the Living with Lakes Centre / Co-operative Freshwater Ecology Unit, who were approved to drive fleet vehicles from 2019 to present.
• Graduate students affiliated with the Living with Lakes Centre / Co-operative Freshwater Ecology Unit, who were paid stipends between 2019 to present.
• Undergraduate medical students and postgraduate residents of the Northern Ontario School of Medicine who entered the program from 2005 to 2019.

“The data associated with these individuals that were exposed varies and we continue to investigate in order to determine the specifics of the data,” the university said.

“Unfortunately, this is a story we’re hearing far too often,” said cyber security expert Ritesh Kotak.

Will take months

“This process will likely take a number of months.”

While the investigation moves ahead, LU said it will be providing everyone affected by the data breach with free credit monitoring for two years.

“This service will allow the impacted individuals to check for signs of identity fraud so protective action can be taken,” the university said.

“This protective service is of significant benefit, and we encourage recipients to take advantage of it.”

All employees and graduate and undergraduate students with the Living with Lakes Centre/Co-operative Freshwater Ecology Unit who are potentially impacted will receive a credit monitoring code for this credit monitoring service by email by 9 a.m. March 7.

“We ask that any undergraduate medical student and postgraduate resident of the Northern Ontario School of Medicine who entered the program from 2005 to 2019 email to obtain their credit monitoring code.”

Kotak told CTV News that he suspects a hacker accessed an employment-related system since many of the impacted individuals at Laurentian are employees.

“They do need to have credit monitoring in place, check their statements on a frequent basis -- which is just good cyber and privacy practice in general," he said.

"But just to be a little bit extra vigilant if they’ve been notified by the university or fall within the category of individuals that have received payment during that specified time from Laurentian.”

Kotak said because much of our life is now digital these types of cyber attacks are happening more frequently.

“If the proper security safeguards aren’t put in place then those conveniences are kind of outweighed by some of the challenges that an organization will face, clearly security, privacy-related breaches,” he said.

Laurentian University reported the incident to law enforcement and the Information and Privacy Commissioner of Ontario.

• Download the CTV News app now
• Get local breaking news alerts
• Daily newsletter with the top local stories emailed to your inbox

University officials are still not conducting interviews or responding to questions about the cyber incident.

Instead, people with inquiries are being directed to laurentian.ca, which is being updated regularly.

– With files from CTVNorthernOntario.ca journalists Dan Bertrand and Angela Gemmill