A cyberattack was carried out against the Pajulahti campus of the Three-Campus Sports Institute on 13 September at 22:24. The attack continues to have a partial impact on the campus’s operations. The authorities were notified immediately after the attack was detected, and corrective measures are ongoing.
Since the beginning of 2023, the Three-Campus Sports Institute has comprised the Pajulahti campus in Lahti, the Kisakallio campus in Lohja and the Mäkelänrinne campus in Helsinki.
The cyberattack targeted the Pajulahti campus’s old data centre, which is in the process of being decommissioned, with completion scheduled for 2027. As a result of the attack, some of the campus’s services are unavailable, and there are deficiencies in systems including key management and property management systems. The cyberattack gained access through a VPN connection.
The investigation has established that the attacker had gained access to some systems and a limited amount of the data stored in them. The data includes financial administration and building technology information, as well as information concerning approximately 150 employees, physical fitness testing data concerning approximately 4,500 people, and names and contact details contained in the customer database. Wherever possible, the Three-Campus Sports Institute has contacted the individuals and stakeholders who may be affected.
The stolen data may be used, for example, for phishing, attempted identity theft or scam messages. Personal identity codes falling into the wrong hands may increase the risk of identity theft, including attempts to apply for credit or place orders in another person’s name.
The campus is cooperating with the authorities and ICT experts
The compromised systems and environments have been isolated, and repair work has begun. The incident has been reported to the Office of the Data Protection Ombudsman and Traficom’s National Cyber Security Centre Finland, and a criminal report has been filed with the Police. In investigating and managing the aftermath of the incident, the campus is following the guidance of the National Cyber Security Centre Finland and the advice of ICT experts.
We apologise for the incident and for the concern and inconvenience it has caused. We have initiated comprehensive corrective measures to rebuild the Pajulahti network environment and restore normal operations during October.
Further information:
Petri Tarkkanen, +358 40 8437300, petri.tarkkanen@kolmekampusta.fi
Irina Keinänen, +358 400 633989, irina.keinanen@kolmekampusta.fi
Three-Campus Sports Institute
The Three-Campus Sports Institute is Finland’s largest provider of vocational education and training in the sports sector and a national sports training centre operating across three campuses: Kisakallio in Lohja, Pajulahti in Nastola and Mäkelänrinne in Helsinki. The Three-Campus Sports Institute is Finland’s only Olympic and Paralympic Training Centre. The Institute also provides leisure services for private customers and services for companies. In addition, the Institute organises several national and international sporting events each year.