Cyberattack gains access to University of Tartu library's online store customer data
The University of Tartu Library informed users of its e‑bookstore that an external attacker gained access to their online store and most likely downloaded the store's customer data.
The Director of the University of Tartu Library, Jaanika Anderson, told online store users that on 11 September they detected a data security incident: an attacker had illegally accessed the store.
The university immediately notified the Information System Authority (RIA) of the incident and suspended access to the online store. The Data Protection Inspectorate was also informed.
"In additional analysis of the incident, the university determined that the attacker very likely also illegally downloaded the online store's customer data, which includes your first and last name, email, phone number, online store username and the encrypted version of the password associated with it, as well as data related to the use of the online store, such as purchase history, IP addresses, etc.," Anderson wrote to online store users.
The attacker likely also accessed customers' usernames and passwords, and although passwords were stored in encrypted form, the library recommends changing them as soon as possible if the same username‑password combination has been used for other accounts, and monitoring for any suspicious activity.
Anderson added that the attacker did not gain access to payment instrument data related to purchases.
The university has suspended access to the online store and will restore it only after a full security analysis has been carried out and security vulnerabilities have been eliminated.
--
Editor: Karin Koppel, Argo Ideon
