Cyber Attack at the University of Calgary

In 2016, the University of Calgary (U of C) was celebrating its 50th anniversary with a variety of events, such as the Congress of the Humanities and Social Sciences, which brought visiting scholars from across the globe. At the same time, Alberta, ON, had been hit with significant forest fires, and many residents that were evacuated from northern communities had moved into U of C residences. The campus was alive with activity when its information technology (IT) systems were encrypted in a ransomware attack. The university’s emergency response team had to act quickly to identify and isolate the root cause of the problem and to decide how to contain it, whether to pay the demanded ransom, and what to tell members of the university and the wider community. The university’s response to this threat and its management through the crisis would ultimately shape the IT team and future investment decisions.

This case is designed for use in undergraduate- and graduate-level courses that cover ethical decision making, such as courses in ethical leadership, organizational behaviour, and management development. The case can also be used in business technology management courses that address cybersecurity and crisis management. The case details the various issues related to cyber security and ransom attacks, which allows students to consider the impacts of a security breach on various stakeholders of a publicly funded institution, and introduces the centrality of ethical values in decision making. After working through the case and assignment questions, students will be able to do the following:<ul><li>Explain the technical, financial, and ethical impacts of ransomware attacks on organizations.</li><li>Describe the consequentialist and deontological approaches to ethics.</li><li>Develop an overview of crisis management processes.</li><li>Create a strategic communication plan to mitigate reputational risks.</li><li>Analyze the importance of communication and participative decision making in crisis management.</li></ul>

• cyber security
• ransomware
• ethics