DIPF-INTERN data leaked by Ragnar Locker

• Ransomware group: Ragnar Locker
• Country: Germany
• Sector: Education
• Announcement date: October 18, 2022

Ragnar Locker claims to have leaked DIPF-INTERN data

The ransomware group known as Ragnar Locker has published a leak announcement on their dedicated leak site, claiming to have compromised data belonging to DIPF-INTERN. According to the announcement, which was posted on October 18, 2022, the group has released approximately 241 GB of data. This incident follows a pattern observed in modern cyberattacks where threat actors utilize leak sites to pressure organizations through public exposure of sensitive information.

The group's announcement suggests that the breach occurred on October 18, 2022. In their statement, the attackers alleged that the institution failed to respond to notifications regarding existing vulnerabilities. As a consequence of this perceived lack of response, the group claims they have proceeded to release the stolen data to the public. The announcement included various file samples intended to demonstrate the validity of the breach, which contained internal correspondence and various pieces of personal information.

Details of the alleged data breach

The data released by the Ragnar Locker group is reported to be quite extensive, totaling 241 GB. Based on the information provided by the attackers, the leaked content includes a wide variety of sensitive documents that could impact both the institution and its members. The files reportedly contain highly confidential information that spans administrative, financial, and personal categories.

The specific types of data mentioned in the leak include:

• Personal data
• Passport information
• Email correspondence
• Financial documents
• Payroll records

The inclusion of such diverse data types, ranging from identity documents to internal communications, highlights the potential breadth of the compromise. Such leaks often involve a mix of corporate intelligence and private individual information, which can be used for various malicious purposes following the initial breach.

About DIPF

The target of this alleged attack is DIPF (Leibniz Institute for Research and Information in Education). This organization is a German research institution dedicated to conducting research on educational processes, systems, and policies. Furthermore, the institute is responsible for analyzing educational data to support academic and policy-driven insights within the sector.

Risk assessment and implications

The nature of the data identified in this leak carries significant risks. The exposure of passport scans, personal email correspondence, and payroll records may significantly increase the risk of identity theft for the employees and researchers associated with the institute. When sensitive identity documents are leaked, the individuals involved face long-term risks regarding their personal security and financial integrity.

Because the institution operates within Germany, this incident may lead to administrative sanctions and legal proceedings under the General Data Protection Regulation (GDPR). The exposure of corporate and personal data can have lasting negative impacts on an institution's reputation and may facilitate secondary attacks, such as phishing campaigns, where attackers use the stolen information to gain further access or deceive employees.

This incident also highlights the risk of double extortion. Ragnar Locker is known for exfiltrating data before initiating the encryption phase of a ransomware attack. This method allows attackers to demand payment not only for the decryption of locked systems but also to prevent the public release of stolen data. While information regarding this specific group remains limited, their tactics are consistent with modern extortion-based ransomware operations.

For organizations in the research and education sectors, such incidents underscore the importance of robust vulnerability management and timely responses to security notifications. Defensive strategies typically involve maintaining strict access controls, implementing continuous monitoring to detect data exfiltration, and ensuring that all identified vulnerabilities are addressed promptly to prevent attackers from gaining a foothold in the network.