Open University of Cyprus fined €45,000 for data breach

The Open University of Cyprus has incurred a €45,000 fine from Commissioner for Personal Data Protection, Irini Loizidou, in connection with a cyber-attack that transpired in March. Commissioner Loizidou issued a statement outlining the final decisions on the Land Registry's cyber attack and the ongoing investigation into the University of Cyprus incident in collaboration with other authorities.

The Commissioner's decision stems from a Personal Data Breach Notification submitted by the Open University in March 2023. The university received a ransom demand from hackers who claimed responsibility for the attack via Twitter. Following the expiration of the ransom timeframe, the stolen data was publicly disclosed on the dark web.

An extensive investigation revealed that the compromised data pertained to students, alumni, and other individuals (University contractors). Eleven complaints were filed by data subjects whose personal information was exposed during the incident.

The Open University has presented a comprehensive plan to enhance its system security, with implementation scheduled until 2026. Despite considering the legal and technical aspects, the Commissioner found the University in breach of the General Data Protection Regulation (EU) 2016/679 due to the failure to implement adequate security measures and a violation of the "accountability" principle.

Considering the University's pre-attack measures, mitigating factors, and its role in the broader public sector, a €45,000 Administrative Fine was imposed. Additionally, the University must appoint a system security officer within six months to oversee the planned security measures and regularly update the Commissioner on the progress of implementation.

[Information sourced from CNA]