Enfield Grammar School data allegedly leaked by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United Kingdom
• Sector: Education
• Announcement date: June 29, 2023

Rhysida group claims to have stolen data from Enfield Grammar School

The threat actor known as Rhysida has listed data allegedly belonging to Enfield Grammar School on its leak platform. According to the group's announcement, they claim to have made a portion of the dataset available for download. This claimed dataset is stated to consist of 18 GB of data and 76 files.

The incident was announced on the group's leak site on June 29, 2023, with the group claiming the attack took place on the same date. While the group has published information regarding the volume and nature of the files, no ransom demand has been specified in the announcement.

Details of the claimed data theft

The information provided by the threat actor includes screenshots that appear to show the internal folder structures of the victim's systems. These visual proofs suggest that the stolen data contains sensitive institutional and personal information. Specifically, the screenshots show folders labeled 'Sage' which are used for year-end reports, as well as a folder named 'passport'.

Furthermore, the group claims that SQL database files are included within the stolen collection. Based on the information released by the group, the following types of data are allegedly involved in the breach:

• Financial reports
• Passport data
• SQL database records

Ransomware leak sites function as a public pressure mechanism used by cybercriminals. In many modern attacks, threat actors utilize a tactic known as double extortion. In this scenario, the attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information beforehand. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to publish the stolen data on these public leak sites to cause maximum reputational and legal damage.

About Enfield Grammar School

Enfield Grammar School is a long-established boys' secondary school located in Enfield, London. Founded in 1558, the institution is a historic school that provides academic education and sixth form services to its students.

Potential risks and implications of the breach

This incident may pose a significant risk regarding the exposure of sensitive financial and personal data belonging to educational institutions. The leakage of identity documents, such as passports, could increase the likelihood of individuals being subjected to identity theft. Because the institution is based in the United Kingdom, this situation may lead to legal consequences regarding data protection obligations under the UK GDPR.

The publication of this data could damage the institution's reputation and potentially create opportunities for targeted phishing attacks against other stakeholders. When sensitive data like financial reports or identity documents are leaked, it provides malicious actors with the necessary context to craft highly convincing social engineering campaigns. Such attacks often target employees, parents, or students by impersonating trusted entities.

To mitigate these risks, organizations in the education sector can implement various defensive measures. These include maintaining robust backup solutions, implementing strict access controls to sensitive directories, and conducting regular security awareness training for staff and students. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations like the UK GDPR are also critical components of a modern cybersecurity posture. Public information regarding the specific operational methods of the Rhysida group remains limited.