DIEM listed on fog ransomware leak site

• Ransomware group: fog
• Country: Italy
• Sector: Education
• Announcement date: February 6, 2025

A claim of data theft against DIEM

The Italian educational institution DIEM has been listed on the leak site of the fog ransomware group. On February 6, 2025, the threat actor known as fog published a post claiming to have obtained data belonging to the organization. This announcement marks a significant development for the institution, as the group's claim suggests a potential compromise of its digital environment.

The threat actor alleges that the data was extracted from Gitlab repositories. While the claim has been made public on a ransomware leak site, public information regarding the fog group remains limited. Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms by threatening to release sensitive information. This tactic is often part of a double extortion strategy, where attackers not only encrypt an organization's systems but also steal data to use as leverage in negotiations.

Details of the alleged incident

The event involves a claim made by the fog ransomware group regarding the unauthorized acquisition of data. According to the announcement, the breach is linked to the institution's use of Gitlab repositories. However, because the threat actor has not provided any screenshots to support the claim, the specific details and the exact nature of the content remain unknown.

The listing names no specific data types that have been stolen.

Organizational profile

DIEM (Dipartimento di Ingegneria Industriale) is an industrial engineering department within the University of Salerno. The department is responsible for conducting academic research and managing educational activities specifically within the field of industrial engineering.

Risks and implications of the claim

This claim suggests that the institution's digital assets and intellectual property may be at risk. The exposure of Gitlab data could lead to the unauthorized access of internal software development processes and source code. Such a breach can compromise the integrity of ongoing research and the security of the software tools used by the department.

As the institution is based in Italy, the incident may trigger data breach notification obligations under the EU General Data Protection Regulation (GDPR). Furthermore, if the leaked data includes employee or student information, secondary risks such as identity theft or targeted phishing attacks may emerge. Organizations in the education sector often manage vast amounts of sensitive personal and intellectual property, making them attractive targets for such attacks.

To defend against these types of threats, organizations typically implement various security measures. These include robust access controls for code repositories, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Regularly auditing permissions and ensuring that software development environments are isolated from general administrative networks are also common defensive steps used to mitigate the impact of potential breaches.