Of the breached details – including emails, usernames and passwords – 57% belonged to Russel Group Universities which include the University of Edinburgh, the University of Glasgow, as well as larger universities like the University of Oxford and Cambridge. 

The findings come from a cyber threat briefing from Crossword Cybersecurity’s Trillion risk monitoring platform. The outcome is a sobering reminder that universities are at high risk of major cyber security incidents. 

The specific dark web sites the credentials were found on were not disclosed in the report, as to not alert the sites to the presence of researchers. However, a spokesperson for Crossword said the researchers are monitoring all of the active market places where credentials are traded and shared.

Universities face unique challenges in securing its network, as it has educators and students all interacting with each other in both an online and in person capacity all around the world. 

“We recognise that these environments are amongst the most uniquely challenging to protect with overlapping requirements for secrecy and openness – so many attack paths need to be factored,” said Stuart Jubb, group managing director at Crossword Cybersecurity.

According to the Higher Education Statistics Agency there were over 2.40 million staff and students in UK universities in the 2021-2022 academic year, with 679,000 of which coming from outside the UK. 

The harvested credentials happened indiscriminately and on an industrial scale, meaning both students and staff were targeted. “Trillion will match up all breached data found to the organisation running the scan based on their domain, and then the IT Security leader at each institution will be able to assess the most high risk account credentials that have the potential to become security threats,” said a spokesperson for the research group.

The research by Crossword also shows some universities were more prone to attacks than others. 54% of breached credentials were directed at schools with research facilities. 

Location wise, 20% of breached credentials came from schools in London, followed by 13% coming from the South East, and 12% from Scotland. Additionally, top 30 universities as listed by Times Higher Education were 50% more likely to have a breach than the others. The University of Edinburgh and the University of Glasgow rank fifth and tenth respectively on that list.

Recommended

• Roundtable | What Can Be Learned From Estonia’s Tech Success?
• Cloud Still Tops Investment Priorities Among UK Businesses
• Vodafone and Three UK Strike a Deal to Merge

“We believe that cyber security practices for all organisations, not just the education sector should include the proactive monitoring for stolen credentials, and a requirement for multi-factor authentication,” said Jubb, prompting Crossword to offer advice and reminders for universities looking to protect accounts against stolen credential breaches: 

• Utilise Two Factor Authentication (2FA) on user accounts, not only internally but also when collaborating with external partners.
• Understand that single sign-on (SSO) does not provide comprehensive protection, as an attacker who gains access to a valid password for an SSO application can exploit it for wider access.
• Resetting passwords alone is not a permanent solution, as new passwords can also be compromised if used across multiple sites.
• Enforce complex password policies, following guidance from organisations such as the National Cyber Security Centre (NCSC), while ensuring passwords are unique for each website.
• Employ third-party tools to monitor and track stolen credentials automatically, promptly alerting organisations and users of potential breaches. 

To download the full report, click here.