The University of Texas at San Antonio said on August 17 that it found attempted unauthorized activity at the edge of its network and took IT systems offline, disrupting student registration and tuition payments days before classes resume on August 19. The university said it had contained the activity with help from outside experts.
The incident had not shown evidence of data access or exfiltration, but the containment move still knocked out services students, faculty, and staff needed to start the term. Phone systems were also unavailable for a time, and the university said it would send passphrase-reset instructions to the campus community.
For universities, this is the tradeoff in plain view: pulling systems down can stop a suspected intrusion from reaching core systems, but if it lands at term start, the operational blast radius hits registration, billing, and campus communications first.