Threat watch / Breach
Charles University: attacker downloads data from the central student information system
Charles University in Prague says one of its web applications was compromised, which gave unauthorised access to data in its central Student Information System (SIS). The technical investigation so far confirms the attacker obtained and downloaded part of the SIS data, including personal information. The application was taken offline, the incident was reported to the national cyber agency NÚKIB and a criminal complaint was filed. The number of people affected is still under investigation.
- Sector
- Education
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- According to the university, one of its web applications was compromised, which gave unauthorised access to data in the central Student Information System. Which application, and how it was compromised, is not public.[1][2] Checked 13 Nov 2026
- What was stolen
- Part of the data stored in the Student Information System, including personal information, which the attacker obtained and downloaded, according to the university. The data categories are not listed.[1][2] Checked 13 Nov 2026
- Who was impacted
- People whose data is recorded in the university's Student Information System. The exact number of people affected is not given and is part of the ongoing investigation; the university says it is assessing measures for them.[1] Checked 13 Nov 2026
- Threat actor
- Not attributed
Timeline
- The university leadership publishes a statement: in recent days it has been dealing with a serious cybersecurity incident, an attacker downloaded part of the SIS data, the compromised application was taken offline, the incident was reported to NÚKIB and a criminal complaint was filed against an unknown perpetrator. It says the exact number of people affected and the full scope are subject to an ongoing investigation. [1]
- LeMagIT lists the incident in its weekly round-up: a compromised web application gave access to the student information system and personal data was exfiltrated. [2]