St. Francis Xavier University had to take its critical IT systems offline after it discovered a scheme to mine cryptocurrency using its network resources.

On Nov. 9, the school’s IT team identified an automated attack launched by unknown threat actors in an effort to steal computing power to mine cryptocurrency, otherwise known as cryptojacking.

After consulting with security specialists, the university, which is based in Nova Scotia, made the decision to disable all network systems. Representatives of the school announced plans to reinstate the offline servers across its network in stages to reduce potential security risks.

Why Did the University Shut Down Its Network?

So far, the university has reported no evidence that the personal information of students, faculty or other parties has been leaked or stolen as part of the attack. To be safe, however, administrators reset the passwords for all university accounts across campus. The IT team said it would continue to look for anomalous behavior over the next month.

The university’s swift response affected basic access to network resources such as Wi-Fi and educational software application Moodle. Meanwhile, student payment cards and debit transactions were temporarily inoperable. The school said it plans to publish a list of which services have been restored and which are still in the queue, such as its MesAmis reporting system and Banner database. The researchers did not explain exactly how the malware was installed on the system.

How to Keep Cryptocurrency Mining Threats at Bay

The St. Francis Xavier University incident is an increasingly rare example of cryptojackers focusing on bitcoin. According to security experts, general-purpose computers are not ideal for bitcoin given the sophisticated nature of its algorithm. Instead, attacks more often exploit IT resources to mine for newer cryptocurrencies such as Monero and Ethereum.

Regardless of what’s being mined, organizations that invest in security information and event management (SIEM) are better positioned to identify cryptojacking before it’s too late to remediate the threat without halting the entire network.

Sources: St. Francis Xavier, ZDNet