Online Services Outage

On Monday, June 12, SFA experienced a cyber incident that caused certain systems to become unavailable. Upon discovery, we severed connections to the internet to contain the activity and began an investigation with the assistance of law enforcement, cybersecurity experts, and UT System colleagues to determine the extent of the incident and return to normal operations.

Upon discovering the incident, we severed connections to the internet to contain the activity and began an investigation with the assistance of law enforcement, cybersecurity experts, and UT System colleagues to determine the extent of the incident and return to normal operations. We have also implemented additional security measures and increased monitoring to help prevent a similar incident from occurring again.

Although our investigation of this incident remains ongoing, we have determined that the unauthorized actor(s) behind this incident acquired certain files from our systems. Our initial evaluation shows the files that were taken primarily consist of non-sensitive data; however, we have identified certain files with individual information – including passport images/applications, health-related information, as well as some government-issued identification numbers. At this time, we have no indication that central information, such as payroll, bank account, or student financial data, has been impacted.

Our investigation is ongoing, so we do not have full details on the specific individuals and types of information impacted at this time. However, as we continue to review the files involved, we will be sure to notify individuals whose information was involved.

Our initial evaluation shows the files that were taken primarily consist of non-sensitive data; however, we have identified certain files with personal information, including approximately 100 individuals’ government-issued identification numbers, as well as approximately 8,600 counseling records.

As of June 22, all primary systems were restored, and we returned to normal operations.

Our teams are working as quickly as possible to review the files that were taken. We will notify individuals whose information was involved directly as required by law. We appreciate your patience as we work to complete the investigation.

We have implemented additional security measures and increased monitoring to help prevent a similar incident from occurring again. SFA is committed to protecting the information entrusted to us, and we will continue working with cybersecurity experts to closely monitor our systems and help ensure our systems remain secure.

Our teams are working as quickly as possible to review the files that were taken. We will notify individuals whose information was involved directly as required by law. Updates can be found at gosfa.com/outage.

As a precautionary measure, we encourage our students and employees to follow best practices to protect their information, including:  

• Keep a close eye on bank and credit card accounts and credit scores.  
• Consider placing fraud alerts or credit freezes with major credit bureaus. 
• Do not trust emails, phone calls, messages or links from unknown sources asking for personal information. 
• Enable two-factor authentication whenever possible.

Check your credit report
You can get a credit report from any of the three credit bureaus, Equifax, Experian and TransUnion, as often as once a week. Be on the lookout for any new accounts you didn't open, any unexpected credit inquiries, or balances that don't match your statements.

Freeze your credit
Freezing your credit makes it more difficult for someone to open an account using your information. Issuing a credit freeze does not affect your score and you can request a freeze at each of the three credit bureaus.

Turn on a fraud alert
If you're currently applying for a loan and don't want to freeze your credit, a fraud alert is a good way to keep your credit safe. You can request a fraud alert from any of the three bureaus.

Monitor your credit
Regularly review your bank, credit card and insurance statements for any unusual activity. If you notice anything suspicious, promptly report it to your financial institutions. You can also visit consumer.ftc.gov for more information on obtaining your credit reports, or placing a fraud alert or credit freeze.

Dear campus community,

As you are likely aware, SFA has been working since Monday, June 12, to recover from and investigate a cyber incident.

Friday morning, June 23, we received information that the threat actors behind this incident claimed to have acquired some data, which might include sensitive or personally identifiable information of some current and former employees and students. In collaboration with law enforcement and external cybersecurity experts, we are in the process of evaluating this information and determining who might be affected.

We will notify any affected parties and provide support to protect against any potential harm. As more information is available, we will share with you. At this time, we have no evidence that central information, such as payroll or employee records or banking or student financial data, has been inappropriately accessed.

We appreciate your patience and understanding, as our Information Technology Services (ITS) professionals work expertly to restore operations and strengthen security.

All faculty, staff and students must change their mySFA passwords as soon as possible following these password reset instructions. If you experience issues resetting your password and you're able to visit campus, log in to an SFA computer and follow these instructions for resetting your mySFA password while on campus. Faculty, staff and students may visit the Steen Library to access an SFA computer.

Wired port

Internet access through wired ports is now available. Students can access the internet via a wired port in their residence halls or ethernet cables in the Steen Library and on-campus computer labs. They may get an ethernet cable from the Steen Library, if needed.

Wireless access

WiFi has been restored on campus. Users experiencing issues connecting should contact SFA's Help Desk at 936.468.4357 (HELP) for assistance from 8 a.m. to 8 p.m. Monday through Thursday and from 8 a.m. to 6 p.m. Friday.

The faculty and staff directory is now working for users on campus.

TouchNet payment software and Banner, our primary business operations systems, have been restored for those on campus.

As a direct impact of the cyber incident earlier this month, Residence Life is conducting manual updates to multiple items from a portion of our servers. Several major processes in the mySFA Residence Life portal are being impacted by these updates and may reflect incorrect information until updates are completed. This includes the option to apply for a private room for fall 2023.

We project these updates will be completed by the end of next week and ask that fall 2023 residents check their accounts after 5 p.m. Thursday, July 13. If the information is still not correct at that time, email reslife@sfasu.edu. All current emails sent to reslife@sfasu.edu will also be answered by that time. Thank you for your understanding and patience.

Email is now working for students on and off campus; email access for faculty and staff is restored on campus when using an SFA computer and off campus when connected to the VPN.

Student Business Services is open for those making installment payments. Systems are operational again, and payment deadlines are unaffected and unchanged.

Payroll for university employees is proceeding as scheduled.

Brightspace by D2L

Brightspace by D2L is coming back online and can be accessed at d2l.sfasu.edu. Depending on your geographic location, you may not be able to connect right away. Over time, it will become available in more areas.

Since parts of the on-campus network are still offline, you'll only be able to access D2L using an off-campus internet connection, such as a cellphone, home internet provider, etc. Additionally, several Nacogdoches businesses, such as coffee shops and churches, are permitting SFA students, faculty and staff use of their Wi-Fi.

Some faculty members and students may be able to access Brightspace by D2L using the Pulse app but only if they already had the app installed on their devices prior to the system outage. Keep in mind that the Pulse app is designed primarily for student use, for the purpose of reading course content and news — it is not recommended for completing coursework such as discussions, Dropbox assignments and quizzes.

Additionally, there are known complications with Duo Mobile, and not all individuals are able to use it. Just as with Pulse, Duo will work only for individuals who had it installed on their mobile devices prior to the system outage. Access to Duo outside the app is currently disabled.

Some users are reporting being asked for an access code; however, SFA does not have a code that will grant them access to the app. For individuals who had neither Pulse nor Duo installed prior to Monday, there is no known workaround for access to Brightspace at this time. We will share more information as it becomes available.

Help Desk assistance for Duo Mobile

Those who are still having trouble creating a Duo account or accessing Duo are encouraged to view this Duo support information. Following the steps in the article will be quicker than calling as the Help Desk is experiencing a large volume of calls and long wait times. If these steps don't resolve the problem, contact SFA’s Help Desk at 936.468.4357 (HELP) for assistance from 8 a.m. to 8 p.m. Monday through Thursday and from 8 a.m. to 6 p.m. Friday.

If you need assistance in person, visit the Help Desk, located on the first floor of the Steen Library, during these hours.

Note: This is not a comprehensive list of our university directory. If you need to reach an office that is not listed, call 936.468.3401. On-campus computers receiving an internet connection can now access the full university directory.

The Lumberjack Wellness Network also offers contact information for campus offices who are available to address concerns that may affect your mental health.