Charles University cyberattack: attacker downloaded part of the study system data

On 13 November 2026 Charles University in Prague confirmed that an attacker used a compromised web application to download part of the data, including personal data, from its study information system. NÚKIB was notified.

In a statement of 13 November 2026, Charles University announced that it is dealing with a cyberattack. The attacker compromised one web application and then gained unauthorised access to data from the central study information system, SIS. The university's technical investigation so far confirms that part of the data stored in SIS, including personal data, was downloaded.

The university took the compromised application offline and secured the related access. It reported the incident to NÚKIB, the Czech national cyber security agency, and filed a criminal complaint against an unknown perpetrator. It is also assessing measures for the people affected. How many people are affected and exactly which data leaked is not yet clear, and the investigation continues.

The university did not name a specific vulnerability; it refers only to one of its web applications. The lesson holds either way: one forgotten or unpatched web application can give an attacker a path to a database that sits behind otherwise well-guarded systems.

What should affected people do? As a precaution, change the CAS UK password and any reused password to a unique one, turn on multi-factor authentication wherever possible, and be careful with e-mails and text messages that claim to come from the university. After a leak of personal data, phishing that uses real details about victims is common.