Scotland's university procurement center confirms cybercrooks broke in
Advanced Procurement for Universities and Colleges (APUC) says attackers gained unauthorized access to historical data in a cyberattack earlier this month.
The Scottish education procurement body said it immediately contained the mid-July intrusion and was investigating claims that some of the data had been stolen.
"We recently discovered suspicious activity on our IT systems involving unauthorized access to certain historic data," an APUC spokesperson told The Register. "We took immediate action to contain the incident and are investigating the scope of it, working alongside external technical specialists. There has been no operational disruption to our day-to-day activities.
REG AD
"We are aware that the group responsible for the unauthorized access has claimed to have taken some historic data from our systems. We are investigating this as a matter of priority. We have notified the relevant authorities and will continue to cooperate with them."
REG AD
APUC is Scotland's procurement center of expertise for universities and colleges, and one of eight members of UK Universities Purchasing Consortia (UKUPC).
These organizations negotiate agreements with approved suppliers, allowing member institutions to buy goods and services without running a separate procurement exercise each time.
APUC arranges these deals as Framework Agreements – pre-vetted terms under which Scottish universities and colleges can place orders with approved suppliers.
MORE CONTEXT
- Pass the key, passwords have passed their sell-by date
- Home Office hands £28M to immigration IT incumbents after procurement challenge
- UK to rethink tech buying after Palantir contracts
- Greedy ransomware crews return for seconds after victims cough up first extortion payments
-
security DEF CON bans Meta-style 'pervert glasses'
-
software Techie lured out of retirement to support software only he remembered
-
security Word worm crawls into Copilot, spreads chaos
-
DATABASES After rewriting SQLite in Rust, Turso turns its sights on Postgres
-
AI and ML Closed models refuse to help researcher swat Linux bug - SYSTEMS A deep dive into Nvidia's Vera CPU and the Olympus cores that power it 88 custom cores, 176 funky threads, 1.5 TB of laptop RAM, and 1.8 TB/s of NVLink connectivity — this isn't your typical datacenter chip
- OFF-PREM Enterprise cloud infrastructure uptake shows no sign of slowing Cloud revenue now north of $143 billion a quarter, and growth is accelerating
- DEVOPS Dev who gave HashiCorp its name returns with a faster terminal multiplexer Persistent sessions could be just the beginning
- SECURITY Anthropic and OpenAI are competing to see whose agents can go rogue harder Whoever wins, we lose
- SYSTEMS UK wants datacenters to pay a fee for grid connection requests Refundable charge intended to discourage time wasters from filing applications that will never be realized
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
- FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another Word up
- GNOME can look like Windows – and Flashback can do it without extensions New 'Simple-taskbar' is an option, but there's a simpler, stabler way
- A moment of silence, please, for the final release of Debian on x86-32 New Debian versions hit FOSSland in the form of 13.6 and 12.15
- Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
- Frame: A new X11 server – implemented directly in assembly Joins yserver, Phoenix, and of course XLibre – and outlier Arcan
- Cinnamon 6.8 will support Wayland – if you want it Next version of Linux Mint’s desktop has both kinds of display server
The organization lists hundreds of Framework Agreements covering contracts collectively worth hundreds of millions of pounds.
APUC confirmed the attack after sources approached The Register with information about the incident.
Those sources claimed APUC received an extortion demand from the criminals behind the intrusion, although we have not independently confirmed that detail.
The Register understands that the crooks claimed to have stolen APUC data dating back 20 years, and gained admin access through an employee account.
We asked APUC about these claims, whether ransomware was involved, and whether it could identify any inaccuracies in the information we received. The spokesperson did not address those questions.
REG AD
At the time of writing, APUC did not appear on any of the major ransomware or extortion groups' data leak sites. ®
[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fscotlands-university-procurement-center-confirms-cybercrooks-broke-in%2F5281654) [](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fscotlands-university-procurement-center-confirms-cybercrooks-broke-in%2F5281654) [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fscotlands-university-procurement-center-confirms-cybercrooks-broke-in%2F5281654) [](https://bsky.app/intent/compose?text=Scotland%27s%20university%20procurement%20center%20confirms%20cybercrooks%20broke%20in%0Ahttps%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fscotlands-university-procurement-center-confirms-cybercrooks-broke-in%2F5281654) [](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fscotlands-university-procurement-center-confirms-cybercrooks-broke-in%2F5281654&title=Scotland%27s%20university%20procurement%20center%20confirms%20cybercrooks%20broke%20in) [](https://api.whatsapp.com/send?text=Scotland%27s%20university%20procurement%20center%20confirms%20cybercrooks%20broke%20in%0Ahttps%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fscotlands-university-procurement-center-confirms-cybercrooks-broke-in%2F5281654)
REG AD