Donna McGettigan (Clare, Sinn Fein)
Link to this: Individually | In context

896. To ask the Minister for Education and Skills for details on the €3.5 million cost following a cyber-attack in September 2024 at Munster Technological University; and if he will make a statement on the matter. [27578/25]

James Lawless (Kildare North, Fianna Fail)
Link to this: Individually | In context

Thank you Deputy for your question about the cyber-attack experienced at Munster Technological University. I would like to start by bringing the Deputies attention to the fact that the cyber-attack occurred in February 2023 and not September 2024.

For context I have provided below a brief overview of the incident followed by a breakdown of the €3.5m costs.

MTU’s Cork campuses were targeted in a cyber-attack on Sunday 5 February 2023. MTU became aware of the attack during its investigation of an IT outage and took prompt steps to intercept and manage the incident. MTU notified law enforcement and relevant regulatory authorities, and worked closely with those bodies throughout the process. The incident resulted in the encryption of certain MTU systems for the purpose of demanding a ransom and the accessing of certain data which was copied from MTU’s internal IT system. MTU had secure backups in place which facilitated full system recovery.

The cost of the response, recovery and resilience projects amounted to approximately €3.5 million as outlined below. The response project involved a significant data analysis and notification process, in accordance with the University’s data protection obligations.

The recovery and resilience process resulted in significant enhancements to MTU’s IT security environment and a significant amount of the rebuild expenditure related to future planned projects which were accelerated as part of the response.

The University did have cyber insurance which facilitated the incident recovery and through which it recovered €0.5 million, which was the limit such insurance cover could be procured for at the time. A ransom was sought in relation to the incident but was not paid.

Breakdown of €3.5m costs incurred: