Scottish university procurement agency reports breach and possible theft of historic data

Advanced Procurement for Universities and Colleges (APUC), the Scottish body that negotiates framework agreements for higher-education institutions, disclosed a cyber intrusion that occurred in early July. An internal review uncovered unauthorized access to historic procurement records, leading the agency to isolate the affected systems and enlist outside technical experts. APUC emphasized that daily services were not disrupted and that law-enforcement agencies have been alerted.

Unverified sources suggest the attackers issued an extortion demand and claim to have exfiltrated data spanning two decades, possibly using an employee’s admin credentials. The organization has not confirmed the presence of ransomware or the exact scope of the stolen information. No evidence of the stolen data appearing on known leak sites has been found so far.