Updated 7 March 2024

Information for those registered in the Primula payroll system – regarding the personal data breach resulting from the ransomware attack on Tietoevry 

The final report from Tietoevry, the provider of Primula for Lund University via the National Government Service Centre (SSC), reports that there is no indication that personal data or other data was extracted from Primula or made available to unauthorised persons during the outage caused by a ransomware attack. The incident meant that employees and contractors at LU did not have access to Primula and therefore the incident is classified as a personal data breach.

Lund University’s assessment is that the incident does not pose a high risk to employees and contractors. 

As personal data in Primula was inaccessible during the outage, the University also reported a personal data breach to the Swedish Data Protection Authority (IMY). IMY decided not to take any action. 

Personal Data in Primula

Primula handles the following personal data about current or former employees at Lund University:

• Personal identity number
• Name
• Address
• Salary
• Employment data
• Leave
• Absence 
• Swedish and foreign contractors (e.g. external experts)
• Those who are paid by the hour or reimbursed for travel and expenses
• Children declared by employees (when registering temporary parental leave/VAB)

Further information

Would you like to know more about what to do in case of a personal data breach? Read more on the following page:

How to manage a security breach involving personal data | Staff Pages (lu.se)

If you have any questions, please contact the University’s data protection officer dataskyddsombud [at] lu [dot] se (dataskyddsombud[at]lu[dot]se)

Updated 13 February at 10:50

Saco members and unorganised employees will receive their new salaries in February – as planned 

As Primula has started up and running again, Saco members and employees who are unorganized will, as planned, receive their new salary (retroactively from the salary review date 1 October 2023) in February.

Updated 7 February at 09:20

Application deadline for the 2023 health promotion  reimbursement: February 29, 2024  

Keep in mind that you should no longer send in your original receipts in paper format, but attach the receipts digitally (scanned, not photographed) when you register your application for compensation in Primula. However, you need to be able to present the receipts in paper format for three months after you have been granted your case in Primula.

Updated 6 February at 16:55

January's salary statement

Statements for the January 2024 salary will be sent out in Kivra and Min Myndighetspost or similar within the next few days.

Updated 2 February at 16:30

Primula is now up and running – this is what you need to do to get the right salary in February 

LU has now gained access to Primula and will open up the possibility to register cases on Friday afternoon. 

To keep in mind: 

• Only register cases that affect salary payments in February – for example, sick leave, care of a sick child, annual leave and other types of leave. This also applies to cases in the SSC Portal. Submit your cases promptly. 
• Keep in mind that your cases need to be handled by several people after you, such as your manager. Contact your immediate manager/HR function for more information. 

No signs of personal data leakage

TietoEvry, which supplies Primula, has announced that it has not yet seen any signs of personal data leaks.

Updated 29 January at 17:00

Primula progress enables payment of February salary 

TietoEvry, which supplies Primula to the University via the National Government Service Centre, has announced that Primula is now calculated to be sufficiently restored to enable the February salary to be paid. As a precautionary measure, the National Government Service Centre is also preparing to activate the back-up salary procedure if, for any reason, the need arises. 

Updated 29 January at 17:00

The last day to apply for the 2023 health promotion benefit is postponed 

Due to the ongoing shutdown in Primula, the last date to apply for the 2023 health promotion benefit (January 31), will be postponed. New date will be announced when Primula reopens.

Health promotion reimbursement | Staff Pages (lu.se)

Updated 26 January at 15:40

Save receipts, use a procured travel agency and ask for Lund University to be invoiced 

Due to the Primula shutdown, there may be a delay in the payment of reimbursements for outlays, travel expenses etc. It is therefore important that everyone assumes responsibility for saving receipts etc., so that the cases can be registered in Primula according to the regular procedure as soon as the system is up and running again. 

Also remember to:

• as far as possible, use a procured travel agency for booking business trips, accommodation etc.
• ask for Lund University to be invoiced for other types of expenses, instead of you as an employee making an outlay. If you are uncertain about the billing address, contact your immediate manager or visit this webpage: Supplier portal | Lund University

Updated 26 January at 10:35

The University has reported a personal data breach as a result of the IT attack against Tietoevry

There is a risk that the personal data processed in Primula has fallen into the hands of unauthorised persons in connection with the IT attack that caused the shutdown of the system. However, Lund University has not yet received any information that confirms this has happened. 

As the IT attack has affected the University’s access to Primula, and thereby access to the personal data, the University has filed an initial report of a personal data breach to the Swedish Authority for Privacy Protection. 

Updated 25 January at 16:30

How to report Primula cases during the shutdown 

During the Primula shutdown it is important that we all manually document the cases that we would normally register in Primula. This is to enable the information to be registered correctly as soon as we regain access to the system.

If you have a Primula case (e.g. notification of sickness or recovery, application for annual leave or other types of leave), you are to contact your immediate manager in order to have the case approved and documented. 

The HR Division is in continuous dialogue with the LUHR network (organisational unit HR managers/equivalent) regarding the ongoing shutdown and the importance of manually documenting salary-related matters and cases as we wait for Primula to be available again. 

Updated 22 January at 16:10

No salary specification via digital mailboxes

The shutdown will not affect the payroll runs for January, but no salary specifications will be sent out via digital mailboxes (e.g. Min myndighetspost and Kivra).

Published 22 January at 10:15

The January salary will be paid as normal

According to information from the National Government Service Centre, the January salary is not affected by the shutdown and will be paid according to the regular procedure.  

As Primula is inaccessible, it is important that each organisational unit manages and documents incoming staff matters (e.g. notification of sickness or recovery) manually.  

The University is currently working to form an overview of the situation and what it means for us at Lund University. The University is also working to establish a dialogue with the National Government Service Centre concerning the contingency procedures that need to be activated and the process involved. 

The shutdown may also entail consequences for other systems and services that use information from Primula. This includes systems such as Lucat, Adato and Varbi. Work is being carried out to pinpoint the consequences and identify the contingency procedures that may be required. 

Updates concerning information about the shutdown and its consequences will be published here.