Bill for 2023 MTU cyberattack has risen from €3.5m to €4.2m

The bill to Munster Technological University (MTU) arising from a February 2023 cyber-attack has risen to €4.2m in direct costs.

According to MTU’s 2024 annual report, the university has also received circuit court legal proceedings from a data subject linked to the attack.

The report states it is not yet possible to assess the outcome of this case.

The €4.2m figure is up from €3.5m reported in 2023.

Professional fees under the heading of “cyber” in 2024 totalled €498,000.

Cork Campus

As a result of the attack, MTU’s Cork campus was temporarily closed following the IT breach and phone outages.

The Kerry campuses remained unaffected. A ransom was demanded but MTU refused to engage.

Following the incident, MTU worked closely with the National Cyber Security Centre, the Data Protection Commission, An Garda Síochána, and relevant government departments.

MTU, established in 2021 from the merger of the Institute of Technology Tralee (ITT) and Cork Institute of Technology (CIT), said a major body of work is underway to align IT systems with best practices in security, recovery, and data monitoring.

The university said new systems and enhanced controls have been introduced, with KPMG engaged to review and implement measures.

Multi-factor authentication (MFA) is now in place for all staff and students.

The report also noted that MTU’s chief information security officer resigned, and the role has been re-advertised as Head of IT Security.

The cybersecurity team has expanded with a new governance, risk, and compliance (GRC) Manager and a senior cybersecurity analyst.

The report confirmed direct costs from the breach currently stand at €4.2m.

Procurement rule breaches

Separately, MTU disclosed procurement rule breaches totalling €433,000 in spending that did not comply with guidelines.

This was mainly due to international student recruitment, outsourced course delivery, and consumable purchases.

For the year ending August 2024 MTU recorded a surplus of €1.76m, with income of €264.23m and costs of €262.47m.

Staff costs were the university’s largest expense, at €150.98m, as staff numbers increased from 1,786 to 1,864.

MTU president Maggie Cusack received €205,000 in pay, while 27 executive management team members shared €3.1m in remuneration.

Staff earning between €100,000 and €110,000 rose from 92 to 258. Those earning between €110,000 and €120,000 increased from 35 to 48.

Some 18 staff earned between €120,000 and €130,000, four between €130,000 and €140,000, one between €140,000 and €150,000, and one between €200,000 and €210,000.