"hinting at some severe trouble within the university's on-premises infrastructure"
Obviously. It's a university. They don't have the money or the intellectual resources to do things properly.
I know I'm not going to make any friends by saying this, but I've never seen a university network without some major, jaw-dropping choices (and I've seen a few), all because the IT people they have were never top-tier in the first place.
In the second place, an "urgent" ticket is generally considered as something that must be fixed this semester. University IT does not live in the same timeframe as its computers. A cyber attack ? That must have reset their clocks in a very hard fashion.
Maybe some good can come of this. And, if indeed there was no data leaked, well their IT guys do deserve a few brownie points.
Now all they have to do is properly segment their data domains and, the next time, they might be able to not lose everything.
I hope their backups are good.