The institution acknowledged earlier this month that it had system troubles, which it labelled a "cyber incident."
The ransomware group Rhysida has now demanded 20 bitcoin (£450,000) for the private data, claiming it would be sold to the highest bidder.
The incident was originally reported to police on July 6. The university's website was down at the time, and an error message apologised for the "inconvenience." Initially, no criminal group claimed credit, but now Rhysida claims responsibility and appears to have attempted to extort the university using the stolen data.
Personal data belonging to personnel, such as bank accounts and national insurance numbers, as well as internal university documents, are marketed on the gang's deep web domain.
The BBC has confirmed that the group listing is genuine, but has been unable to verify the data's veracity.
However, according to the BBC's cyber correspondent Joe Tidy, it is unlikely to be a hoax.
SOURCE: BBC NEWS | JULY 28 2023
