Charles University hit by data breach, asks users to change passwords

Charles University has confirmed a serious cyberattack in which an intruder accessed and downloaded information, including personal data, from its central Study Information System, known as SIS.

The university is still establishing how many people were affected, exactly what information was taken and whether it has been misused.

Users of the university’s Central Authentication Service, CAS UK, have been asked to change their passwords within 10 days of receiving an email notification. The university described the request as a precaution to strengthen account security.

According to the university, the attacker compromised a web application and subsequently gained unauthorized access to information held in SIS.

The university said it took security measures immediately after discovering the incident, including shutting down the compromised application and securing the relevant access points.

It has reported the attack to Czechia’s National Cyber and Information Security Agency, NÚKIB. Prague police also confirmed Friday afternoon that they had received a report and were investigating.

“We are currently dealing with it and establishing all the circumstances,” police spokesman Richard Hrdina told ČTK.

NÚKIB spokesman Jakub Neščiva confirmed that the agency was handling the incident but said the ongoing investigation and its legal confidentiality obligations prevented it from providing further details.

The university has not yet established the full extent of the breach. Its statement confirms that some information was downloaded, rather than merely accessed.

Charles University said it would publish further confirmed findings and relevant measures as the investigation progresses, taking account of security considerations.

The password request was sent to students by email and applies to users of CAS UK, which provides authentication for university information systems.

The deadline runs from receipt of the notification. The university described the change as preventive; the information released so far does not establish whether account passwords were among the data taken.

The incident follows a recent cyberattack at the Czech Technical University in Prague, which shut down some systems and said it had stopped the attack.

CTU linked its incident to worldwide attempts to target websites using PHP after critical security vulnerabilities were announced. No connection between the two university incidents has been established in the information released.

Separately, Microsoft service disruptions affected Czech ministries and other organizations on Friday. Microsoft’s Czech branch said there was no indication that those outages resulted from a cyberattack or deliberate damage.

Charles University’s investigation remains focused on determining the scope of the stolen information and any subsequent misuse, while securing the affected systems.