ElDorado ransomware group lists www.itasnatta.edu.it on its leak site

• Ransomware group: ElDorado
• Country: Italy
• Sector: Education
• Announcement date: June 6, 2024

The ElDorado ransomware group has announced on its leak site that it has compromised data belonging to the Italy-based Istituto di Istruzione Superiore Giulio Natta, operating under the domain itasnatta.edu.it. According to the announcement made on June 6, 2024, the threat actor claims to have successfully exfiltrated a significant amount of information from the institution's network.

Details of the alleged attack

The threat actor known as ElDorado has posted an announcement regarding the compromise of the entity operating under the domain itasnatta.edu.it. In the post, the group claims that they have obtained data from the institution's network and are currently offering this information for sale on their leak site. While the group has made this claim public, it is important to note that information regarding this specific group remains limited.

The incident was announced on June 6, 2024, which coincides with the date the group claims the attack occurred. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to pressure the victim into paying a ransom by threatening to leak the information publicly.

Data involved in the leak

Regarding the specific contents of the alleged breach, the group has provided limited information. The listing specifies the volume of the data but does not provide a breakdown of the specific types of files or information that were targeted. The claims regarding the data are as follows:

• The total size of the claimed data is 40.5 GB.

The listing does not provide any specific details regarding the nature of the alleged leaked data, other than the stated size of 40.5 GB. No information was provided regarding the specific file count or the specific types of documents involved in the breach.

Potential impact and implications

Given that the affected entity is an educational institution, it is possible that the leaked data contains personal information of students and staff. The exposure of such sensitive data can lead to various secondary risks for the individuals involved, including the increased possibility of identity theft and the likelihood of targeted phishing attacks. Such attacks can exploit the personal details of students and employees to gain further access to other systems or to conduct financial fraud.

From a regulatory perspective, this incident may lead to legal sanctions and administrative processes under the European Union's General Data Protection Regulation (GDPR). Educational institutions are required to maintain high standards of data protection, and a breach of this nature can trigger significant compliance investigations. Furthermore, attacks on the digital infrastructure of educational institutions can negatively impact operational continuity and cause lasting damage to the institution's reputation.

To mitigate such risks, organizations within the education sector can implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication across all systems, and conducting regular security awareness training for both staff and students. Additionally, monitoring network traffic for unusual patterns can help in the early detection of unauthorized data exfiltration. Maintaining a strong incident response plan is also essential to minimize the impact of such breaches on the institution's operations and reputation.