Security Incident Notice

Dear users,

On behalf of the Institute of Slavic Studies, Polish Academy of Sciences, pursuant to Article 34 of the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), we are writing to inform you of a personal data breach that may have affected your data stored on the Open Journal Systems (OJS) academic journal platform (journals.ispan.edu.pl).

 

1. What was the nature of the breach?

On October 15, 2026, between 02:52–04:15, an authorized person gained access to the OJS platform by using a compromised password belonging to one of the editors, and exploiting a software security vulnerability.

The perpetrator obtained system administrator privileges and may have gained access to the database as well as unpublished scholarly materials and peer reviews.

The breach was detected on October 15, 2026 at about 11:00. Access to the platform was immediately blocked, and security measures were taken.

 

2. What data may have been affected?

The breach may have affected the data of about 7,900 users of the platform, including authors, peer reviewers, editors, and members of the editorial boards of the journals.

An unauthorized person may have gained access to the following data:

• names and surnames;
• email addresses;
• academic and institutional affiliations;
• cryptographic representations of passwords (so-called hashes);
• information contained in unpublished academic articles, submissions to the journals, and peer reviews.

The analysis of logs and network traffic did not reveal any data being exfiltrated from the server. However, it cannot be ruled out that the perpetrator gained access to or made a copy of this information.

 

3. What could be the consequences of the breach?

Potential consequences include:

• attempts to gain unauthorized access to other online accounts, especially if you have used the same or similar passwords;
• attempts at online fraud, impersonation, or phishing (soliciting information via fake emails);
• breach of data privacy and confidentiality;
• the possibility of unauthorized use of unpublished scholarly materials, infringement of copyright, breach of confidentiality of the peer review process, and harm to the scholarly and professional interests of the authors.

Given the nature of the scholarly materials, the Institute is unable to assess independently all potential consequences of their disclosure. The authors should assess for themselves whether any unauthorized use of their materials could infringe their rights or harm their interests.

 

4. What measures did the Institute take?

As soon as the incident was detected:

• unauthorized access to the platform was blocked;
• the malware and the account created by the perpetrator were removed;
• the compromised password and existing access keys were invalidated;
• a system security analysis was carried out;
• a new version of the OJS platform was installed, and the security vulnerability exploited was patched;
• a mandatory password reset for all users was implemented, and the requirements concerning the length of passwords were increased.

Secure functionality of the platform was restored on October 17, 2026.

 

5. What should you do?

To mitigate possible adverse effects of the breach, we recommend that you:

• Change your OJS platform password the first time you log in after service has been restored.
• Immediately change your passwords in other services and systems if they are the same as, or similar to, the password that you have used on the OJS platform.
• Use strong, unique passwords for each service and enable two-factor authentication where available.
• Be particularly vigilant regarding emails requesting that you provide your password or personal data, or that you open suspicious attachments.
• If you are the author of an unpublished scholarly work – we recommend that you assess whether potential disclosure of the materials could result in copyright infringement, breach of research confidentiality, or harm to other legitimate interests. Should you become aware of any unauthorized use of the materials, please contact the Institute.

 

6. Where can you obtain additional information?

If you have any questions concerning personal data breach or its potential consequences, please contact the Data Protection Officer at the Institute of Slavic Studies, Polish Academy of Sciences:

• Name and surname of the DPO: Dr Krzysztof Radtke
• email: iod@ispan.edu.pl

 

We apologize for this incident and any inconvenience it may cause. We would like to assure you that we treat the security of personal data as a priority, and that we implemented measures to mitigate the impact of the incident and prevent similar occurrences in the future.

 

Yours sincerely,

Dr hab. Ewa Golachowska, Associate Professor
Director of the Institute of Slavic Studies, Polish Academy of Sciences