The University of Professional Studies, Accra (UPSA) has uncovered a major cybersecurity and academic integrity incident after investigations revealed that more than 500 academic results were altered in the university’s information system.
The investigation has implicated 178 students, with the university withholding the graduation of some students linked to the alterations.
Speaking during UPSA’s 18th Congregation, Vice-Chancellor Professor Kwaku Mensah Mawutor said investigations established that some students and other individuals had breached the university’s system and manipulated academic results.
He described the incident as a serious institutional concern, saying some students admitted paying individuals to change their results, while others were found to have collected money from colleagues to facilitate similar alterations.
Is This a Cyberattack?
From a cybersecurity perspective, the incident involves an important element of a cyberattack: unauthorised access to an information system and unauthorised modification of data.
However, it would be premature to describe the incident specifically as an external cyberattack or hacking campaign without further technical details from UPSA.
Cybersecurity incidents can originate from several sources, including external attackers, compromised accounts, malicious insiders, or individuals who obtain legitimate credentials and misuse them.
In the UPSA case, the university has publicly stated that students and other individuals breached its system. This points to unauthorised system access and data manipulation, but the precise method used to obtain access has not been publicly explained.
If an individual bypassed technical security controls to gain access, that could constitute hacking or unauthorised intrusion. If legitimate credentials were obtained and misused, the incident could involve account compromise or insider-assisted access. If authorised users deliberately altered records outside their permitted duties, it could instead involve privilege abuse.
More technical findings would be needed to determine exactly how the system was compromised. For now, the incident should therefore be understood as a serious unauthorised-access and academic-records manipulation incident, with further technical information needed before conclusively labelling it an external cyberattack.
The case also serves as a reminder that protecting student records is not merely an administrative responsibility. It is a core cybersecurity, data protection and institutional trust responsibility.
About The Author
