Sign up for The Brief, The Texas Tribune’s daily newsletter that keeps readers up to speed on the most essential Texas news.
More than a week after Stephen F. Austin State University was hit with a cyberattack, leaders at the public university in the East Texas Pineywoods are still working to fully restore email and other online services for the 11,600-student campus.
University spokesperson Graham Garner confirmed Tuesday that the Federal Bureau of Investigation is looking into the incident, which occurred about 10 days ago, but did not provide any additional details. In a statement, a spokesperson for the FBI Dallas field office confirmed the investigation but declined to provide more information about the investigation.
While the university has restored access to the internet and the university’s online teaching portal, students and faculty say the hack has caused serious disruptions, especially for students taking summer courses.
Macie Torres is earning her early childhood education degree online at SFA while also working as a special education paraprofessional in the Dallas-Fort Worth area. She said she signed up for five summer courses this year because she was on vacation from her job and could devote more time to focus on her classes and lab work.
The disruption happened just before her midterms, completely cutting off her access to her professors and classmates more than 150 miles away. The incident has thrusted her intensive six-week semester into chaos. She spent the last week tracking down professors as she refreshed the website every 30 minutes to see if the connection was restored.
“I started to panic and worry about when I would graduate, if this will affect my classes,” she said.
The university said the cyberattack occurred sometime between June 10-12. Once it was discovered, the school cut off internet access to stop any further breaches to its system.
Since then, the University of Texas System has helped SFA investigate and respond to the attack. SFA is in the midst of joining the UT System after the Texas Legislature recently approved legislation allowing the independent university to join the UT system.
Garner said SFA police are working with the FBI on the investigation. He said the university has not found evidence that any personal or sensitive financial information was accessed in the breach. The attack also appears unrelated to a ransomware attack from a Russian group that hit multiple federal agencies, U.S. companies and state governments.
Colleges and universities have increasingly become targets for ransomware attacks, experts say, because they often store staff and students’ personal information, financial records and sensitive research.
Ransomware is malware that is designed to block a user or organization from accessing their own networks, usually for a ransom payment. An individual at the UT System who has knowledge of the investigation confirmed the attack on SFA was from ransomware.
Garner referred questions to law enforcement about whether the university was asked to make any kind of payment to unlock its systems.
According to a 2022 report from Sophos, a cybersecurity company in the United Kingdom, higher education globally has seen an increase in ransomware attacks over the past few years. The report also found that higher education institutions recover from such attacks at a slower rate than other sectors surveyed, with 40% of survey respondents saying it took more than a month for them to fully recover.
Over the past week, SFA has restored certain online services and the university website. But according to posts on social media, many students say they are still struggling to regain access to the school’s online learning platform and get caught up on assignments.
On Sunday, SFA leaders said all employees were required to change their passwords.
“As SFA works to restore email, we want to remind faculty, staff and students to avoid clicking on any link in any email you might receive about resetting your password, etc.,” the university wrote on its website. “SFA will not send any emails making requests like this, so these are phishing attempts.”
A phishing attempt is when hackers try to trick a user into providing access to sensitive information like bank account numbers or login credentials, which can help a hacker gain access to a network.
Garner said the university was able to continue providing meals and housing to the 2,000 to 2,500 students on campus. A scheduled freshman orientation was held as planned last week. Summer camps continued, too.
Posts on the university’s Facebook page show that professors teaching summer courses have shared information and updates about classes in some posts’ comments section, with many encouraging students not to panic about the situation.
“If you’re in Dr. Gravatt’s BIOL 1306 or BIOL 1308, first take a deep cleansing breath and relax,” Dennis Gravatt, a professor of biology at SFA, commented on the university’s Facebook page. “I promise it is not the end of the world. Patience is the key to success. When communications get back to normal the lecture schedule will be adjusted. I don’t have any more access to SFA than you do.”
Torres said she was surprised by the outpouring of help from people in the Nacogdoches community. At one point, she posted on a local Facebook group that she was struggling to reach her biology professor. A person in the community unrelated to the university messaged her and said they knew the professor and would call her on Torres’ behalf.
Ultimately, all of her professors have provided accommodations, including canceling some assignments, extending deadlines and merging other assignments together. But with 10 days left in the semester, Torres said she’s worried about getting everything done in time.
“I knew I would struggle in these areas and now I feel like I’m gonna struggle even more,” she said.
She said any disruption can pose challenges for students trying to balance school with all of life’s other responsibilities.
“It’s really just annoying because we have a plan,” she said. “There are single moms who are doing summer classes. There are people trying to jump back into the education world for summer classes. For this to happen, that kind of doesn’t motivate them to try more.”
Disclosure: Facebook and University of Texas System have been financial supporters of The Texas Tribune, a nonprofit, nonpartisan news organization that is funded in part by donations from members, foundations and corporate sponsors. Financial supporters play no role in the Tribune’s journalism. Find a complete list of them here.
Go behind the headlines with newly announced speakers at the 2023 Texas Tribune Festival, in downtown Austin from Sept. 21-23. Join them to get their take on what’s next for Texas and the nation.
