Coop UQAM listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Canada
• Sector: Education
• Announcement date: April 29, 2025

Rhysida claims data breach at Coop UQAM

The Rhysida ransomware group has listed Coop UQAM on its dedicated leak site, claiming responsibility for a cyberattack against the organization. According to the announcement made on April 29, 2025, the threat actors claim to have obtained sensitive information from the systems of the Quebec-based cooperative. This incident follows a pattern of double-extortion tactics frequently employed by ransomware groups, where attackers not only encrypt an organization's data but also threaten to leak it publicly to increase pressure for payment.

The group has issued a ransom demand of 5 BTC in exchange for the alleged stolen data. In their communication, the attackers have established a seven-day deadline for the payment. Furthermore, the threat actors have stated that the stolen information will be sold to a single buyer rather than being released freely to the public immediately, a tactic that may influence the negotiation process or the eventual misuse of the information.

Data types and contents identified in the leak

While the specific volume and exact count of the files involved have not been disclosed, the group has provided visual evidence to support their claims. Screenshots released by the attackers appear to show samples of various documents that were allegedly exfiltrated from the organization's network. These samples suggest that the breach involves significant amounts of internal business documentation.

The documents identified in the leak samples include:

• Commercial invoices
• Contracts
• Business correspondence

The presence of these specific document types indicates that the breach may involve sensitive financial and legal information essential to the daily operations of the cooperative.

About Coop UQAM

Coop UQAM is one of the largest school-based cooperatives in Quebec. Located on the UQAM campus in downtown Montreal, the institution primarily serves university students and staff. As a major entity within the university ecosystem, the cooperative plays a vital role in providing services to the academic community in the Montreal area.

Analysis and potential implications

The claim made by the Rhysida group poses several significant risks to the organization. For the members and business partners of Coop UQAM, the leak of internal documents could lead to secondary risks, such as identity theft or various forms of fraud. Because the organization operates within Canada, this breach may trigger specific data privacy obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), requiring the institution to follow strict regulatory protocols regarding data protection and notification.

Given that the Rhysida group has a history of targeting the education sector using double-extortion methods, the organization's operational continuity may be negatively affected by this event. The threat actor's claim that the data will be sold to a single buyer increases the potential for the information to be misused, even if it is not released to the general public. In such scenarios, organizations typically face the need to conduct a comprehensive forensic investigation to determine the full scope of the leaked data and the exact extent of the unauthorized access.

To mitigate the impact of such attacks, organizations in the education and cooperative sectors often focus on strengthening their defensive postures. This includes implementing robust backup solutions, maintaining strict access controls, and conducting regular security awareness training for staff and students. Furthermore, having a well-defined incident response plan is essential for managing the legal and operational fallout of a potential data exfiltration event.