Advanced Procurement for Universities and Colleges (APUC), Scotland’s procurement body for higher and further education, has confirmed that attackers accessed some historical data during a cyberattack in mid-July. The incident matters because APUC manages framework agreements used by Scottish universities and colleges to purchase goods and services, although it says its daily operations have not been disrupted.

APUC says it contained the intrusion promptly, engaged external technical specialists and notified the relevant authorities while investigating the scope of the breach. Criminals have claimed to have stolen historical data, with sources alleging an extortion demand and data going back 20 years after access through an employee account; APUC did not confirm those details or whether ransomware was involved. The organisation oversees hundreds of agreements collectively worth hundreds of millions of pounds and was not listed on major ransomware or extortion leak sites when the article was published.