Bolin Centre for Climate Research listed on fog ransomware leak site

• Ransomware group: fog
• Country: Sweden
• Sector: Education
• Announcement date: February 4, 2025

The Bolin Centre for Climate Research has been listed on the leak site of the threat actor group known as fog. The listing, which appeared on February 4, 2025, follows a claimed attack that occurred on February 3, 2025. This development indicates a potential security incident involving the research institution.

The claimed attack and event details

According to the claims made by the group known as fog, the threat actor gained unauthorized access to the institution's digital environment. The group has publicly listed the Bolin Centre for Climate Research on their dedicated leak site as part of their typical operations. While the group has made these claims, the incident remains an allegation from the threat actor side.

The group asserts that they have successfully accessed the organization's Gitlab environment. This type of targeting, where attackers focus on development repositories, is a known tactic used by various ransomware groups to maximize the impact of a breach. By targeting version control systems, attackers aim to secure high-value intellectual property that is central to an organization's operations.

Data involved in the leak

The threat actor claims to have exfiltrated a significant amount of data during the incident. Specifically, the group reports that a data set measuring 5 GB has been leaked in connection with this incident. The specific contents of the files are tied directly to the access the group claims to have obtained within the institution's development infrastructure.

The listing identifies the following as the affected data:

• Source codes

The exposure of such technical assets is a critical concern for any research-driven organization. In many modern cyberattacks, particularly those involving double extortion, threat actors not only encrypt an organization's systems but also threaten to release sensitive information on public leak sites to pressure the victim into paying a ransom.

About the Bolin Centre for Climate Research

The Bolin Centre for Climate Research is a specialized research center based at Stockholm University. The center is dedicated to conducting interdisciplinary research focused on climate systems and environmental change. Its primary scientific objective is to conduct studies that help the scientific community understand the various causes and the resulting impacts of climate change.

Implications and organizational risks

This incident may pose significant risks to the institution's intellectual property and its sensitive research data. Because the Bolin Centre for Climate Research is based in Sweden, the nature of the leaked information could trigger data protection obligations under the General Data Protection Regulation (GDPR), depending on what the specific contents of the 5 GB data set entail.

Furthermore, the exposure of source codes is particularly dangerous as it may facilitate secondary attacks against the institution's digital infrastructure. When attackers possess the underlying code of an organization's software, they can identify vulnerabilities more easily to launch subsequent intrusions. This incident could potentially lead to disruptions in the institution's research processes and compromise the overall security and integrity of its academic work.

In the broader context of cybersecurity, organizations in the education and research sectors often face unique challenges. Protecting academic integrity and proprietary research data is paramount. When faced with such threats, organizations typically focus on strengthening their access controls, implementing multi-factor authentication, and enhancing monitoring of their development environments like Gitlab. While information regarding the specific group fog remains limited, the potential for academic and operational disruption remains a high priority for the affected institution.