University of Michigan restores internet access, still mum on security issue

• University of Michigan internet access was restored Wednesday 
• U-M shut off campus internet Sunday afternoon after discovering a ‘significant security concern’
• U-M officials still won’t say when they will release information on the nature of the security concern

Internet access on the University of Michigan campuses was restored Wednesday, U-M President Santa Ono announced in an update, ending nearly four days of disruption for more than 100,000 students and staff.

A “significant security concern” had prompted the university to shut down its internet services Sunday afternoon, but U-M has yet to release details on the nature of the problem, saying doing so “might compromise the investigation,” a stance the university held to Wednesday.  

U-M Regent Paul Brown told the Detroit News there was a “targeted attack on our institution” and that “with IT security, it’s not an ‘if’ but a ‘when.’”

Related:

• University of Michigan internet outage wreaks havoc on first day of class
• Graduate students settle strike at University of Michigan

In announcing the reconnection of campus internet, Ono cautioned that officials still “expect some issues with select U-M systems and services in the short term, and not all of our remediation efforts are complete.” He said that any lingering issues “will be resolved over the next several days.”

The University of Michigan Division of Public Safety and Security and federal law enforcement are investigating the issue. Bridge Michigan asked the university when it expects to release additional information on the security concern.

“We do not have any other information we can share on the investigation,” university spokesperson Kim Broekhuizen said Wednesday. “We do not want to share anything that might compromise that important work.” 

The internet shutdown created challenges for students and staff during the first week of the fall term, which began Monday. On the Ann Arbor campus, staff set up tents and information stations where students could ask for help locating their class locations and times. 

On Monday afternoon, the university announced it had restored access to cloud services including Canvas, the learning management system that holds class syllabi and assignments. 

Brett Callow, a threat analyst at global cybersecurity company Emsisoft, told Bridge on Tuesday that he suspected the university detected a compromise in its network that “could, had it remained undetected, resulted in a ransomware attack.”

Ransomware attacks allow hackers to gain access to networks where, once inside, they can steal and then lock the computers that hold the stolen data. Then, the attackers request money in exchange for unlocking the computers and deleting the stolen data. 

College and university systems can be particularly challenging to secure because they are expected to be open to a wide group of people including staff, students and the community, Callow said. 

Callow said there have been 56 postsecondary schools in the U.S. impacted by ransomware this year and at least 50 of those had data stolen. He said he does not know how many institutions paid money to retrieve that data and prevent the data from being released. 

UCLA was among dozens of institutions and companies that had data stolen during a cyberattack in June.