Monitoring - Instances of the phishing email have been removed, and the website attempting to trick users into disclosing personal information was blocked through the University campus network, through opening the link in Office 365, and by the University Sophos anti-virus software.
Anybody who is concerned they may have been affected by disclosing personal information is encouraged to utilise the UK's national Action Fraud resource, which can be found at https://www.actionfraud.police.uk
Aug 2, 16:00 BST
• Telephone the IT Service Desk urgently if you have entered your username/password into a fake login site, or if you have opened a suspect attachment on an email - do not email the IT Service Desk in these situations, instead telephone them or live chat them as a speedy response can be important • Inform IT about a suspected phishing email by using the Report Message button within Outlook - there is no need to email IT or forward the phish email in addition to this
Aug 2, 11:07 BST
Identified - We are aware that a number of users have received a phishing email relating to a fictitious staff portal.
These phishing emails have a subject line similar to "PLEASE READ: Important Message" and seem to come from support@minekc.com. The email refers to an important message from Staff Portal, and asks that the attachment on the email be opened to proceed. The email has an attachment named MyCardiff_Staff_Portal.html which ultimately prompts for username and password.
Work is already underway to find, remove, and block these malicious emails, along with any web addresses they link to.
Search for Scam emails on the staff or student intranet for information on how to spot phishing & scam emails, how to report them, how to get help from IT if affected, and how to stay safe online.
Aug 2, 09:50 BST
Monitoring - Microsoft have released a feature update called "Shared Calendar Improvements" for Outlook which amongst other benefits should help with changes being propagated swiftly, and should address the issues users have been reporting in this incident.
Investigating - We received reports that some users have been encountering issues with shared mailboxes & calendars, and their delegate access.
Some of the reported unusual behaviours include created/updated entries not propagating or disappearing, error messages, access issues, and Outlook crashing.
We are currently investigating this issue and will be working with Microsoft on identifying workarounds, the root cause, and resolutions.
Ben Rowett - IT Service Manager
Jun 1, 10:34 BST
Communication & Collaboration
Degraded Performance
Desktop Telephony
Operational
Email & Calendar (Outlook)
Degraded Performance
Microsoft Teams
Operational
Netcall (Call Centre functionality)
Operational
Skype for Business (Telephony & Instant Messaging)
Operational
Yammer
Operational
Zoom
Operational
Computers, Software, & Printing
Operational
Desktop, Laptops, & Mobile devices
Operational
Printing, Copying, & Scanning
Operational
Published Applications online (Horizon)
Operational
Remote PC Access (Horizon)
Operational
File Storage
Operational
Home & Shared drive (H: & S:)
Operational
OneDrive for Business
Operational
Finance Systems
Operational
Financial and Procurement System (Oracle-EBS)
Operational
Help & Support
Operational
Service Desk Support (IT single point of contact)
Operational
IT Portal (Self Service ticket logging)
Operational
Student Enquiry (GECKO)
Operational
LinkedIn Learning
Operational
HR & Student Record Systems
Operational
PeopleXD (Core HR)
Operational
SIMS (Admin)
Operational
Library Systems
Operational
Electronic Resources
?
Operational
Library Management System (ALMA)
Operational
LibrarySearch (Primo)
Operational
Reading Lists (Leganto)
Operational
Network
Operational
Wired Network Connectivity
Operational
Wireless Network Connectivity
Operational
Virtual Private Networks (VPN)
Operational
Public Website & Intranet
Operational
Public Website (Squiz)
Operational
Intranet (Squiz)
Operational
Research
Operational
ARCCA Processing and Analysis (Hawk)
?
Operational
ORCA & Manage My Publications
?
Operational
Research Data Store
?
Operational
Research Portal (Converis)
?
Operational
Room & Equipment Bookings
Operational
Resource Booker
Operational
Room Bookings (Syllabus Plus / Scientia)
Operational
Resolved -
No further issues have been observed with the IT Service Desk ticketing system. The issue is therefore considered to be resolved.
Paul Jones - Service Manager
Aug 9, 15:16 BST
Monitoring -
We have now re-enabled access to the IT Service Desk ticketing system, including access to the IT Portal, and we are monitoring the system.
The backlog of emails is now being processed.
Please bear with us whilst we also follow-up on the calls that were inadvertently closed.
Apologies for any inconvenience this has caused.
Paul Jones - Service Manager
Aug 8, 16:20 BST
Update -
In order to analyse the issue and to ensure that the problem is not further exacerbated, we will be disabling access to the IT Service Desk ticketing system. This includes the IT Portal.
Please note that this also means that any emails sent to the IT Service Desk (via it-servicedesk@cardiff.ac.uk) will not be processed.
If your call is urgent, please contact the IT Service Desk via telephone at 029 2251 1111. . If your call is not urgent, then we would kindly ask that you delay emailing the IT Service Desk until tomorrow. This will help us keep the backlog of emails to a minimum and ensure that we can still provide the best service possible.
We apologies for any inconvenience this may cause.
Paul Jones - Service Manager
Aug 8, 10:05 BST
Update -
We are continuing to investigate this issue.
Aug 8, 09:18 BST
Investigating -
University IT are aware of an issue with the ticketing system used by the IT Service Desk. It appears that calls are being inadvertently closed. Our technical staff are currently investigating this issue.
An update will be provided as soon as more information is available.
Aug 8, 09:17 BST
Resolved -
Access to SIMS Client has been restored.
Apologies for any inconvenience this issue has caused.
Paul Jones - Service Manager
Aug 9, 11:58 BST
Investigating -
University IT are aware of an issue with access to the SIMS Client and technical staff are currently investigating. Note that SIMS Online is unaffected.
An update will be provided as soon as more information is available.
Aug 9, 11:06 BST
Resolved -
This incident has been resolved.
Aug 5, 12:52 BST
Monitoring -
Our suppliers have informed us that a fix has been implemented and they are monitoring the results. They are also continuing to work through the backlog of submissions that have been affected by this incident, so you may still see a delay in report generation. Apologies for any inconvenience caused.
Aug 5, 11:38 BST
Update -
We are continuing to investigate this issue.
Aug 5, 10:28 BST
Investigating -
University IT are aware of an issue with Turnitin. Our suppliers are currently investigating.
An update will be provided as soon as more information is available.
Aug 5, 10:24 BST
When is it being done? Between 00:00 and 05:00 on Thursday, 04th August 2022.
Who will this affect? All intranet users.
How will this affect users? There should be no impact. However, there is a possibility of certificate warnings being displayed during the renewal process. The renewal itself should take no longer than a few minutes.
Why is it being done? To ensure security, continuity of service and customer experience is maintained.
Completed -
The scheduled maintenance has been completed.
Aug 4, 00:00 BST
In progress -
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Aug 3, 08:00 BST
Scheduled -
Hawk (University Supercomputer Service) - Planned Maintenance on Wednesday 3 August
What is being done? ARCCA are undertaking planned maintenance on the Hawk supercomputer and supporting infrastructure.
When is it being done? This will next take place on Wednesday 3 August. This maintenance day is scheduled regularly for the first Wednesday of every month. This is to ensure maximum awareness and allow our service users to plan ahead.
Who will this affect? All users of the ARCCA Hawk University supercomputing service and supporting infrastructure.
How will this affect users of the service? Hawk and supporting infrastructure will be at risk and so we advise users to save their work regularly on this day.
Why is it being done? Hawk maintenance occurs as required on the first Wednesday of each month. This can be either be as a “Maintenance Outage” period or an “At Risk” period. This is to allow us to perform security patches, system upgrades, equipment replacements and other essential work.
Christopher Dickson - Service Manager
Jul 21, 09:37 BST
Resolved -
The issue with Student Records (SIMS) has now been resolved. If staff or students continue to experience problems they suspect is caused by this incident, they should contact the IT Service Desk:
Monitoring -
A fix has been implemented and the issues affecting Student Records (SIMS) should now be resolved. Engineers are continuing to monitor the service.
Aug 1, 13:48 BST
Update -
Problems with SIMS Online and Client remain ongoing and engineers are working to identify the issue.
Aug 1, 10:28 BST
Investigating -
University IT are aware of an issue with SIMS Online, and technical staff are currently investigating.
An update will be provided as soon as more information is available.
Aug 1, 09:40 BST