“We are aware that the group responsible for the unauthorized access has claimed to have taken some historic data from our systems.”

Twenty years of data walked out through a single employee account. APUC runs framework agreements worth hundreds of millions of pounds for Scottish universities, so one intrusion reaches every member institution at once. The statement leans on “no operational disruption to our day-to-day activities,” which measures the wrong thing entirely. Nobody’s Tuesday was ruined. Two decades of procurement records still left the building.