As Memorial shared on Dec. 31, 2023, the university has been experiencing a cybersecurity incident affecting Grenfell Campus.

Memorial became aware of IT issues on Dec. 29. Security protocols were immediately put in place to isolate the impacted systems, launch an investigation and advise the authorities.

Although our investigation into the incident remains ongoing, we can confirm this was a ransomware attack. An unauthorized third party gained access to the Grenfell Campus network and encrypted data on a number of servers and workstations. As a result, Grenfell IT services were rendered unavailable.

Since discovering the incident, a team of university experts has been working tirelessly with external cybersecurity experts to mitigate impacts on academic, research, student and administrative activities at Grenfell Campus. Memorial’s containment efforts include isolating the Grenfell network, collecting and analyzing evidence, implementing additional security measures and monitoring tools, scanning and ensuring the safety of data before restoring it in a safe and controlled environment and resetting passwords, among others.

Thanks to these collective efforts, in-person classes at Grenfell Campus resumed on Jan. 8, 2024. IT systems and services on the St. John’s campus, which were not impacted by the incident, were extended to the Grenfell Campus to speed up recovery efforts. Work to recover systems involved in this incident is underway. Recovery will take several weeks and services and systems will look different than they did before this incident.

We want to acknowledge and express our appreciation to all employees, particularly the faculty and staff at Grenfell Campus, who are working together to support our students. We are also grateful to our students for their patience and resilience as they returned to classes under these unusual circumstances.

Memorial remains committed to protecting the information entrusted to us and maintaining operations for students, faculty and staff to the fullest extent possible.

At this time, we do not have any evidence that any information, personal or otherwise, was compromised in this incident. If our investigation determines that personal information has been compromised, we will advise the Office of the Information and Privacy Commissioner of Newfoundland and Labrador (OIPC) and directly notify impacted individuals as appropriate.

Memorial is co-operating fully with law enforcement. We reported the incident to the National Cybercrime Coordination Centre, a unit of the RCMP, on Dec. 30. We advised the RNC of the incident on the same date. We also reported it to the Centre for Cyber Security and the Canadian Anti-Fraud Centre. We provided a courtesy notice to the OIPC out of an abundance of caution.

We appreciate everyone’s understanding that we are limited in what we can share while the investigation is ongoing. We will continue to provide updates on mun.ca/updates as information is available.