ALPHV ransomware group claims data breach at eivp-parisfr

• Ransomware group: ALPHV
• Country: France
• Sector: Education
• Announcement date: July 26, 2023

ALPHV claims a major data breach at eivp-parisfr

The ransomware group known as ALPHV has announced that it has compromised the corporate network of eivp-paris.fr. According to the group's announcement on their leak site, the attack resulted in the exfiltration of a significant amount of information. The group claims to have stolen more than 30 GB of data from the institution.

The group has stated that all available data will be published if the ransom is not paid. To support their claims, the group has shared several samples of documents that they allege were stolen from the institution. These samples include various types of personal and corporate information, such as passports, visa documents, and financial statements.

Details of the alleged data exfiltration

The breach, which the group claims occurred on June 2, 2022, involves a wide range of sensitive information. Based on the samples provided by the attackers, the data allegedly stolen includes various categories of highly sensitive information that could impact both individuals and the institution's operations. The types of data mentioned in the claim include:

• Social Security Numbers (SSN)
• Driver's licenses
• Credit card information
• Student data
• Financial documents
• GDPR protected data

The presence of such diverse data types, ranging from identification documents like passports and driver's licenses to financial statements and student records, highlights the potential scale of the exposure. The group's use of screenshots to display these samples is a common tactic used by ransomware actors to pressure victims into paying ransoms.

About eivp-parisfr

EIVP (École des Ingénieurs de la Ville de Paris) is a public engineering school specializing in urban engineering. The institution operates under the patronage of the Paris City Hall. Founded in 1959, the institution focuses on education and research in urban planning and urban infrastructure.

Potential impact and implications of the breach

The exposure of this data carries significant risks. For the individuals involved, including students and employees, the leak may increase the risk of identity theft. The nature of the stolen data, which includes identification documents and financial information, could leave these individuals vulnerable to targeted phishing attacks. In such scenarios, attackers use stolen personal details to craft highly convincing fraudulent communications to deceive victims.

Furthermore, because the institution is located in France, the breach could lead to legal consequences under GDPR regulations, as the leaked information includes data protected under these privacy laws. The group's tactics suggest that the stolen data might be used as a secondary extortion tool, a common method in modern ransomware attacks where attackers threaten to release sensitive information even if the network is restored from backups.

For organizations operating in the education sector, such a breach can create negative impacts on both academic and administrative processes. The disruption caused by a cyberattack can affect the continuity of research, teaching, and the management of student and staff records. To mitigate such risks, organizations generally focus on strengthening their defensive posture through measures such as implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training for staff and students.