Fog ransomware group lists Gitlabs: Chalmers tekniska högskola, Fligno, 3SS on its leak site

• Ransomware group: Fog
• Country: Sweden
• Sector: Education
• Announcement date: February 7, 2025

Fog ransomware group claims data breach of three organizations

The threat actor known as Fog has issued an announcement on its leak site claiming to have compromised and leaked data belonging to three distinct entities: Chalmers tekniska högskola, Fligno, and 3SS. This claim, made on February 7, 2025, suggests a targeted operation against these organizations, though public information regarding the specific identity and operational history of the Fog group remains limited.

In modern cyberattack landscapes, ransomware groups often employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information prior to the encryption phase. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure victims into paying a ransom. While the specific ransom demands for this incident have not been disclosed, the act of publishing data via torrent files is a common tactic used by such groups to ensure the information remains accessible to the public and interested parties.

Details of the alleged incident

According to the announcement published on February 7, 2025, the Fog group claims to have successfully exfiltrated data from the three named organizations. The threat actor provided torrent files for each of the entities involved. Each of these files allegedly contains approximately 5 GB of data, bringing the total claimed data volume to 15 GB across all three targets. The timing of the announcement coincided with the claimed date of the attack itself.

Regarding the specific contents of the files, the listing does not provide a detailed description of the nature of the leaked data. The announcement mentions the presence of the files but lacks specifics regarding the types of documents, databases, or sensitive information contained within the 5 GB chunks. Consequently, the exact scope of the information exposure remains unverified beyond the group's claims.

Potential impact and organizational risks

The alleged data leak poses significant risks to the affected organizations, which span different sectors including education and technology. For academic institutions such as the Sweden-based Chalmers tekniska högskola, such an incident can lead to serious concerns regarding compliance with the General Data Protection Regulation (GDPR) concerning the protection of personal data. The exposure of academic or personal information can disrupt the educational mission and damage the institution's reputation.

For technology-focused companies like Fligno and 3SS, the implications of a data breach can be equally severe. These organizations may face secondary risks, including the potential loss of intellectual property and the erosion of customer trust. When proprietary information or client data is compromised, the long-term commercial impact can be substantial. Furthermore, the public release of such data increases the risk for employees and stakeholders, who may become targets for identity theft or highly targeted phishing attacks.

To mitigate the risks associated with such threats, organizations typically focus on strengthening their defensive posture. This includes implementing robust data encryption, maintaining strict access controls, and conducting regular security audits. Organizations in the education and technology sectors are particularly encouraged to maintain comprehensive incident response plans and to ensure strict adherence to data protection regulations to minimize the impact of potential exfiltration events.