Cyberattack attempts on universities highlight a growing risk: Confusion

The University of Texas at San Antonio (UTSA) recently found itself confronting a challenge that is becoming increasingly familiar across higher education: a cybersecurity incident arriving at precisely the wrong moment. Just days before the start of the 2026 fall semester, university officials detected attempted unauthorized activity targeting the institution’s technology systems. According to UTSA, the activity was identified at the edge of the network before reaching core systems, and the university acted quickly by taking multiple services offline as a precaution. Investigators subsequently reported that they had found no evidence that university data had been accessed or exfiltrated.

While the swift response appears to have prevented a major breach, the incident nevertheless disrupted university operations sufficiently to delay the start of the semester and create widespread inconvenience for tens of thousands of students, faculty, and staff.  The episode serves as a reminder that in modern cybersecurity, disruption alone can have significant consequences, even when attackers fail to steal data.

Universities have long been attractive targets for cybercriminals. Unlike many organizations that operate relatively uniform technology environments, higher education institutions often resemble small cities connected by high-capacity networks. According to John Bruggeman, virtual Chief Information Security Officer (vCISO) at CBTS, universities combine many of the attributes that attackers find attractive. “Higher education is a very, very target-rich environment,” Bruggeman explains.

Universities typically maintain large collections of personally identifiable information (PII), payment card data, healthcare information, academic records, and research data. In the United States, institutions must also comply with regulations such as FERPA, PCI DSS, and, in some cases, healthcare privacy requirements. Beyond sensitive data, campuses typically support thousands of users and an extraordinary range of connected technologies, including laptops, desktops, smartphones, gaming consoles, security cameras, videoconferencing systems, laboratory equipment, industrial control systems, and Internet of Things (IoT) devices. The result is a highly complex attack surface that is difficult to secure comprehensively.

The UTSA incident demonstrates how the impact of a cyber event can be amplified by timing. The attempted intrusion occurred just before the start of the academic year, one of the busiest operational periods for any university. Students were attempting to finalize class schedules, make tuition payments, access course information, and communicate with administrative departments.  To maintain security, UTSA temporarily limited access to various services, extended payment deadlines, and postponed the beginning of classes from August 19 to August 24.

Although these actions were intended to protect institutional systems, operational impacts quickly spread beyond information technology. Registrar offices, admissions departments, financial aid teams, and student support services all faced additional pressure as concerned students sought clarification regarding system availability and academic schedules. This reflects a broader reality of modern cyber incidents: they are no longer solely IT problems. They are business continuity events affecting every part of an organization.

The hidden danger: social engineering

Perhaps the most important lesson from the UTSA incident is not the attempted intrusion itself but what can happen in its aftermath. Cybersecurity professionals increasingly recognize that disruption creates uncertainty, and uncertainty creates opportunity for attackers. Students expecting emails about tuition payments, class registration, password resets, waitlist changes, or restored access to services may be more inclined to trust unexpected communications appearing during a period of confusion. For instance, a carefully crafted phishing email sent during such an event can appear entirely legitimate.

Attackers do not necessarily need access to university systems to exploit the situation. Instead, they can leverage publicly known disruptions as part of social engineering campaigns. For example, an email claiming that a student’s account requires verification, that a payment must be resubmitted, or that class registration needs immediate action may appear completely plausible when sent during an ongoing outage. This phenomenon has become increasingly common following major cyber incidents, with criminals often using public knowledge of disruptions to increase the credibility of phishing campaigns.

Not an isolated event

The UTSA incident follows another significant cybersecurity challenge affecting higher education institutions. Earlier in 2026, numerous educational organizations were impacted by the compromise of the widely used Canvas learning management platform, an attack attributed to the ShinyHunters cybercriminal group. That incident affected educational institutions globally and highlighted the interconnected nature of modern academic technology ecosystems.

The increasing reliance on cloud-based applications means that institutions are no longer responsible only for securing their own infrastructure. Universities must also assess and manage risks arising from third-party vendors, educational software providers, and cloud platforms. Consequently, cybersecurity strategies increasingly focus not only on perimeter defence but also on supply-chain assurance, zero-trust architectures, identity protection, and incident response readiness.

One of Bruggeman’s key observations is that universities should think more broadly about preparedness. Traditional cybersecurity planning often focuses on technical recovery: restoring systems, rebuilding servers, resetting credentials, and identifying attackers.

Yet people can be just as vulnerable as technology. Bruggeman argues that institutions should proactively educate students regarding cyber risks and establish trusted communication channels before incidents occur.

Universities routinely conduct emergency preparedness exercises addressing physical threats, severe weather, and public safety issues. Cybersecurity incidents deserve similar attention. Tabletop exercises can help departments identify communication challenges, decision-making responsibilities, escalation pathways, and trusted sources of information before a real incident occurs. When students already know where official updates will be published, they are less likely to trust fraudulent messages claiming to provide urgent assistance.