Cost of 2023 cyber attack on Munster Technological University rises to €4.2m

Institute is in receipt of one set of Circuit Court legal proceedings over attack, annual report shows

MTU was set up in 2021 and comprises the former Institute of Technology Tralee and Cork Institute of Technology. Photograph: Philip O’Reilly, MTU
MTU was set up in 2021 and comprises the former Institute of Technology Tralee and Cork Institute of Technology. Photograph: Philip O’Reilly, MTU

The bill to Munster Technological University (MTU) arising from a February 2023 cyber ransomware attack has risen to €4.2 million.

That is a €700,000 increase on the €3.5 million cost put on the attack in the university’s 2023 annual report.

.

As a result of the ransomware attack, the MTU Cork campus was closed temporarily following the “significant” IT breach and phone outages. The Kerry campuses were unaffected.

A ransom had been demanded but MTU had “not engaged”.

Arising from the incident, MTU has engaged in close contact with the National Cyber Security Centre, the Data Protection Commission, An Garda Síochána and other relevant stakeholders including Government departments.

MTU was set up in 2021 and comprises the former Institute of Technology Tralee (ITT) and Cork Institute of Technology (CIT).

The institute’s 2024 annual report states that following the 2023 attack “a large body of work is under way” across the MTU IT environment to best align IT systems with leading practices”.

The report states that “a series of systems and enhanced controls have been put in place”, including multifactorial authentication for staff and students.

It also notes the chief information security officer has resigned from their position and left MTU. The role has been re-advertised under the new title of head of IT security, “to attract other potential candidates”.

Separately, the report also discloses that weaknesses in relation to compliance with procurement rules and guidelines were identified and €433,000 expenditure was incurred where the procedures employed did not comply with the guidelines.

The main reasons for noncompliance were international student recruitment, outsourced course delivery and the purchase of consumables.

MTU recorded a surplus of €1.76 million in the 12 months to the end of August 2024 and recorded an income of €264.23 million and costs of €262.47 million.

The university’s largest cost was staff at €150.98 million as numbers employed increased from 1,786 to 1,864.

Pay to MTU president Prof Maggie Cusack totalled €205,000 for the year.

  • Sign up to Classroom to College, our essential newsletter to navigating the Leaving Cert for parents, guardians and students

  • Join The Irish Times on WhatsApp and stay up to date

Gordon Deegan

Gordon Deegan

Gordon Deegan is a contributor to The Irish Times