'Malicious' email hack among 122 data breaches at University of Galway since 2024
The cyberattack caused finance-related emails sent to a staff member to be automatically forwarded to a ‘fraudulent actor’ outside the university
A “malicious” and successful attempt to hijack a staff member’s email that affected nearly 190 people was among 122 data breaches recorded by the University of Galway since 2024, Galway Live can reveal.
The cyberattack involved the implementation of an auto-forwarding rule on the employee’s email account, which resulted in finance-related messages being automatically forwarded to a Gmail account outside the university.
An investigation into the data breach could not identify the date on which the email account became compromised, but it established that this had occurred between September 2018 and March 2021.
During that period, all emails received by that staff member containing the words “invoice”, “wire”, “transfer”, “payment”, or “remittance” were sent to the external Gmail account.
The incident was disclosed in the latest financial accounts for the university, which said the “malicious” auto-forwarding rule appeared to have been put in place by a “fraudulent actor”.
It was ultimately established that the incident had resulted in a breach involving the “high-risk” personal data of 187 individuals. The incident was notified to the Office of the Data Protection Commissioner.
It was one of 122 data protection breaches recorded by the university since 2024, according to records obtained in response to a request under the Freedom of Information Act.
A total of 47 such incidents were recorded in 2024, followed by another 52 in 2025, and 23 have been recorded by the university since the beginning of this year, the records show.
Once the email breach was “discovered and mitigated”, the university used an external security operations centre and Microsoft to establish what material had been disclosed to the party responsible, and what degree of risk was involved.
The investigation was “significantly hampered” by the fact that so much time had elapsed since the “malicious” email forwarding rule had been put in place, according to the financial accounts.
Mandatory cybersecurity awareness training was introduced for all staff in the wake of the incident, which involved targeted training on the risks of auto-forwarding, and recognising phishing and social engineering.