chort ransomware group lists hartwick.edu on its leak site

• Ransomware group: chort
• Country: United States
• Sector: Education
• Announcement date: November 17, 2024

Hartwick College targeted by chort ransomware group

The threat actor known as chort has listed Hartwick College on its leak site. According to an announcement made by the group, the institution has been compromised, with the threat actor claiming to have gained unauthorized access to the organization's internal systems.

Details of the alleged attack

The chort group published a post on November 17, 2024, asserting that they have successfully compromised data belonging to hartwick.edu. The threat actor alleges that they have gained access to the institution's databases and files. In the post published on the leak site, the status of the institution is currently marked as 'Wait for Decision'.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. These sites often feature a countdown timer or a status update to signal the stage of the extortion process. When a group uses the 'Wait for Decision' status, it typically suggests that the attackers are waiting for a response or a ransom payment from the target before proceeding with further actions, such as publishing the stolen data.

Data involvement and content

Regarding the content of the allegedly leaked data, there is no detailed information provided by the threat actor. While the group claims to possess database and file contents, no specific details regarding the nature of these files have been disclosed. Furthermore, the threat actor has not provided any screenshots to substantiate their claims of having access to the institution's data.

The listing names no specific data types or categories of information that have been exfiltrated.

About Hartwick College

Hartwick College is a private liberal arts college located in Oneonta, New York. It is an established higher education institution offering a variety of undergraduate academic programs.

Analysis and implications for the education sector

This incident may indicate potential vulnerabilities in the institution's data security processes. Depending on the nature of the leaked data, the exposure of student and employee information could lead to identity theft or targeted phishing attacks. For institutions in the education sector, such incidents may trigger legal processes under regulations like FERPA or similar data protection laws.

The threat actor may be employing the double extortion method to exert pressure on the institution. Double extortion is a common ransomware tactic where attackers not only encrypt the victim's data to disrupt operations but also steal sensitive information beforehand. The threat of leaking this data publicly serves as additional leverage to compel the victim to pay the ransom.

In such scenarios, organizations often face significant challenges in managing both the operational recovery from encryption and the reputational and legal fallout from data exposure. For the education sector, protecting sensitive student and faculty information is a critical component of institutional security. While information regarding the chort group is limited in the public domain, the trend of targeting educational institutions remains a significant concern for cybersecurity professionals globally.