FHNW listed in data leak announcement by fog ransomware group

• Ransomware group: fog
• Country: Switzerland
• Sector: Education
• Announcement date: March 6, 2025

Swiss educational institution FHNW targeted by fog ransomware group

The Swiss-based educational institution FHNW has been listed in a data leak announcement by the threat actor group known as fog. According to the claim, the group has successfully targeted the institution, leading to a significant data exposure announcement on a leak site.

Details of the claimed attack

The fog group claims to have obtained 93 GB of data belonging to FHNW. This claim was made in a list published on March 5, 2025, with the official announcement appearing on a leak site on March 6, 2025. The announcement suggests that the data was extracted from the institution's GitLab infrastructure. While the group has made these claims, information regarding this specific threat actor group remains limited.

Ransomware groups often utilize leak sites to publicize their successful breaches. This tactic is frequently part of a double extortion strategy, where attackers not only encrypt an organization's systems but also steal sensitive information to pressure the victim into paying a ransom. By threatening to release stolen data, attackers aim to maximize the leverage they hold over the target organization.

Data involved in the leak

The announcement specifies that GitLab data belonging to FHNW has been leaked. However, no detailed breakdown of the file contents is provided, and the listing names no specific data types.

Potential implications of the exposure

The exposure of source code or intellectual property hosted on GitLab could negatively impact the institution's supply chain security. When technical infrastructure such as version control systems are compromised, the integrity of the development lifecycle and the security of the software produced by the institution may be at risk.

About FHNW

FHNW (University of Applied Sciences and Arts Northwestern Switzerland) is a university of applied sciences located in northwestern Switzerland. It offers undergraduate and postgraduate degree programs in various fields, including engineering, business, design, social work, and music.

Analysis and organizational impact

The leak claim may indicate a potential security vulnerability within the institution's academic and technical infrastructure. As a Swiss-based institution, the incident could lead to legal obligations under the Swiss Federal Data Protection Act (FADP) and the General Data Protection Regulation (GDPR). Depending on the nature of the leaked data, the exposure of personal information belonging to researchers or students may increase the risk of identity theft.

The threat actor's method of publishing the data may be intended to exert pressure on the institution. For organizations in the education sector, such incidents highlight the importance of robust security measures. Common defensive steps for organizations include implementing strong access controls, ensuring regular software updates, and maintaining comprehensive logging and monitoring to detect unauthorized access to sensitive repositories like GitLab.

In the broader context of cybersecurity, educational institutions are often targeted due to the high value of intellectual property and the large volume of personal data held by students and faculty. Protecting this data requires a multi-layered defense strategy that addresses both technical vulnerabilities and the human element of security.