Information-technology experts from across Colorado convened at Regis University on Tuesday to learn never-before-shared details about last year’s crippling cyberattack — an experience the private Jesuit college’s chief information officer called “a crisis of the highest order.”
The Denver Post reported new details about the cyberattack Tuesday morning, confirming for the first time the Denver campus’s computer networks were struck by ransomware, leading school leaders to pay the hackers in the early days of the months-long incident.
Jagan Gudur, Regis’s chief information officer, wouldn’t disclose how much the university paid, skimming over the ransomware details during Tuesday’s conference.
In response to follow-up questions from The Post, Salvador Aceves, Regis’s senior vice president and chief financial officer, said paying the ransom was successful because the university was able to restore its files. He noted that some systems remained inoperable months later because not all cyberattacks are the same.
Officials said the decision to pay or withhold ransom in a cyberattack is “situational.”
“At the time, given what we knew, we are confident we made the right decision,” Aceves said.
Gudur shared two timelines at the summit, outlining steps Regis took in the hours, days and months after the attack.
A few new details revealed during the presentation:
- Federal and third-party investigators were unable to determine a root cause of the attack, meaning it’s unclear how the attack originated
- The hacker — determined to be from outside the country — attacked Regis’s backups first
- In a matter of days after the attack that knocked out the university’s internet, email and phone systems, Regis’s IT team prepared more than 100 classrooms to be used for the start of the fall semester
- When faced with the decision to rebuild the IT system or repair it, officials decided to rebuild and update
“The simple rationale I would offer is that I had a house and a venomous snake got in, and my children were in the house,” Gudur told attendees of the cybersecurity summit. “I could go hunting for the snake. I called the local wildlife department, and they couldn’t tell me how the venomous snake got in. I said, ‘We’ll build a new house and move our children to that house.’ ”
Shari Plantz-Masters, dean of Regis’s College of Computer & Information Sciences, said she was involved in addressing the “human side” of the attack — responding to the repercussions on students, staff and faculty who were trying to start the semester without access to most technology and communication systems.
“I remember sitting in the meeting with the dean and saying we need to go old-school,” Plantz-Masters said, recalling how class registration worked when she was a college student. “We went very analog. We learned we were way more creative than we realized. We also realized how important it is to find ways to connect in a human way.”
The university used the Slack messaging service to help the campus community to talk. Students physically picked up paper schedules telling them where to go. Regis used social media platforms to spread information.
“Our business continuity was probably the biggest eye-opener,” Plantz-Masters said. “We had become so used to our systems, we didn’t understand where we needed to have backup systems.”
Plantz-Masters said the experience bonded members of the Regis community, many of whom volunteered to help during the attack in one way or another.
Another positive outcome, she added, was realizing an improved opportunity for two of Regis’s colleges. In May, Regis will integrate its Anderson College of Business and its College of Computer and Information Sciences into a new college of business and computing.
“The cyberattack that hit Regis in August crystalized the need to meld business and technology into a common curriculum so the business students graduate more fluent in managing technology and data science, and computer science and cybersecurity students graduate with a strong foundation in how businesses operate and rely on IT,” said Jennifer Forker, Regis University spokeswoman.