A February 2024 ransomware attack encrypted some East Central University computers and servers in Ada, Oklahoma. Critical services remained operational, while the university reset passwords, deployed replacement servers and investigated possible access to personal information.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
East Central University in Ada, Oklahoma, experienced a ransomware attack on Feb. 16, 2024, according to contemporary reporting. The university identified BlackSuit and said the attackers encrypted utility and file servers and affected campus computers. Its account establishes a disruptive cyberattack. Increased malicious email before the attack does not establish how the attackers entered.
The university’s notice distinguished affected computers and servers from critical services, which it said remained operational. Staff brought in an outside response team, reset passwords, gathered forensic evidence and deployed replacement servers to restore affected services. The confirmed disruption was limited to part of the computing environment; available evidence does not establish canceled classes or a universitywide shutdown.
The incident is presumed resolved based on its age and the absence of evidence of continuing operational disruption. An exact complete-restoration date remains unverified. The continuing data investigation described in April does not establish that services remained unavailable until then.
The victim’s identification supports high confidence in the BlackSuit attribution, although the underlying forensic findings were not publicly released. KXII’s April 9 report said names and Social Security numbers might have been accessible, while actual access or theft remained unconfirmed. Potential exposure should not be treated as confirmed exfiltration.
Public evidence does not establish the initial access method, number of encrypted devices, exact restoration date, number of people whose information was exposed, whether data was actually accessed or stolen, or whether a ransom was demanded or paid.
The university identified BlackSuit in its incident FAQ and described encryption of utility and file servers while critical services remained available. This record reflects victim attribution rather than an authenticated group-controlled victim-list post. The statement does not independently establish actual access to or theft of personal information.
Ada anchors the university campus where computers and servers were affected; this does not establish an Ada municipal outage.
ECU said some computers were attacked while critical services remained operational. Names and Social Security numbers may have been accessible, but access and theft were unconfirmed.
The report dates the attack to Feb. 16 and reproduces part of ECU’s notice naming BlackSuit. Its quoted notice describes potential personal-data exposure without confirming theft.
ECU identified BlackSuit, confirmed encryption of utility and file servers, and said critical systems remained unaffected. It described replacement servers and password resets while leaving actual data access or theft unconfirmed.
Signed-in members can report an error, update, or missing source.
