Following a thorough forensic investigation by third-party experts, we can confirm there is no evidence of any data theft from our systems following a cyberattack, late last month.
The services impacted by the attack are a portal for our UK Research Office (UKRO) based in Brussels and an extranet (often known as the BBSRC extranet) used by our Councils.
The UKRO portal provides an information service to subscribers. The extranet is used to support the peer review process for various parts of UKRI.
The attack resulted in data being encrypted by a third party. We reported the incident to the National Crime Agency, the National Cyber Security Centre and Information Commissioner’s Office.
We were able to promptly recover our data, without recourse to paying anybody, and we have put in place temporary measures to enable critical work to continue safely.
Given the risk of theft of personal data, we contacted both extranet and portal users to ensure they were aware of that risk and to provide advice and guidance. We sent out emails to people identified as being potentially impacted.
Third-party forensic analysis was immediately undertaken to ascertain whether data – including personal, financial or other sensitive data – had been stolen. We can now update users of these services that we are confident that there is no evidence of data theft.
UKRI takes incidents of this nature extremely seriously. We continue to work to re-instate impacted services and will update again in due course.
We apologise again to all those who will have been concerned about any potential impact on their own data privacy.