Funksec ransomware group lists sorbonne-universite.fr on its leak site

• Ransomware group: Funksec
• Country: France
• Sector: Education
• Announcement date: March 7, 2025

Funksec claims to have breached Sorbonne Université

The threat actor known as Funksec has officially listed Sorbonne Université on its dedicated leak site. According to the announcement made on March 7, 2025, the group claims to have successfully targeted the prestigious French institution. This listing follows a pattern common in modern cyberattacks, where ransomware groups utilize leak sites to pressure victims by threatening to release sensitive information to the public if certain demands are not met.

The group alleges that the attack took place on March 7, 2025, the same day the announcement was posted. While the group has published this claim on their platform, the details regarding the specific methods used to gain access to the university's network remain unconfirmed by the source. Such listings are a hallmark of double extortion tactics, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage for extortion.

Details of the alleged data theft

The Funksec group claims to have exfiltrated a significant volume of information from the university's infrastructure. The group asserts that the total size of the stolen data is approximately 20 GB. The announcement suggests that the breach involves various types of sensitive information that could impact the institution's internal operations and academic integrity.

According to the claims made by the threat actor, the stolen data includes:

• Credentials
• Research reports

The group has provided screenshots to support their claims, which allegedly consist of screen captures taken directly from the victim's devices. These images are intended to serve as proof of the unauthorized access and the presence of sensitive files within the attacker's possession.

About Sorbonne Université

Sorbonne Université is a prestigious public research university located in Paris, France. It conducts education and research activities in the fields of science, medicine, humanities, and social sciences. As a major hub for academic excellence, the institution manages a vast array of sensitive research data and personal information belonging to a large community of scholars and students.

Potential impact and security implications

This alleged breach may pose a significant risk of exposure for student and staff data within the university. Because the institution is based in France, any potential data breach could be subject to the EU General Data Protection Regulation (GDPR), which imposes strict requirements on how personal data must be protected and how breaches must be reported. The exposure of sensitive information can lead to long-term consequences for both the institution and the individuals involved.

The specific risk associated with the leaked information is multifaceted. The exposed credentials could be utilized for secondary attacks or targeted phishing campaigns against the institution's network. When attackers obtain valid login information, they can often bypass traditional perimeter defenses, making subsequent stages of an attack much easier to execute. Furthermore, reports suggesting that the Funksec group utilizes AI-powered tools may indicate increased complexity in their operations, which could potentially impact the institution's operational continuity.

For organizations in the education sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps include implementing multi-factor authentication (MFA) to mitigate the risk of credential theft, maintaining rigorous patch management schedules, and conducting regular security awareness training for staff and students to defend against phishing. Additionally, maintaining offline, immutable backups is a critical component of a resilient defense strategy to ensure operational continuity in the event of a ransomware incident.