Funksec ransomware group lists univ-rennes.fr on its leak site

• Ransomware group: Funksec
• Country: France
• Sector: Education
• Announcement date: March 8, 2025

Funksec claims data breach at University of Rennes

The ransomware group known as Funksec has listed the University of Rennes on its leak site, claiming to have successfully exfiltrated a significant amount of data from the institution. According to the announcement made on March 8, 2025, the threat actor claims to have acquired 50 GB of data from the university's systems. The group has reportedly provided a 10-day window for the institution to establish contact to resolve the matter.

This type of activity is characteristic of modern ransomware operations, specifically the double extortion model. In such scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the stolen data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information, which can lead to significant reputational and legal consequences.

Details of the alleged data theft

The announcement made by Funksec provides a detailed list of the types of information they claim to have obtained during the attack. The group alleges that the stolen data consists of a wide variety of sensitive files and databases that could compromise the university's operations and the privacy of its members. The claimed data includes the following:

• Student information
• Email data
• Source codes
• Financial data
• System configuration files

Beyond these broad categories, the group claims the cache includes PDF files, CSV and SQL databases, GitLab projects, system information, emails, phone numbers, invoices, credentials, SSH keys, and API keys. The presence of technical credentials such as SSH and API keys is particularly concerning for any organization's security posture.

About the University of Rennes

The University of Rennes is a prominent public university located in Rennes, France. It serves as a major higher education institution within the region, conducting extensive educational and research activities. As a large-scale academic institution, it manages a vast amount of sensitive data related to its students, faculty, and research projects.

Risk assessment and defensive considerations

This alleged leak poses a significant risk to the privacy of both student and staff data within the university. The inclusion of highly sensitive technical assets, such as SSH keys and API keys, in the claimed data could significantly increase the risk of secondary attacks against the institution's digital infrastructure. These credentials can provide attackers with direct access to systems, potentially allowing them to move laterally through the network or escalate privileges.

Furthermore, because the institution is based in France, this incident may trigger mandatory data breach notification requirements under the General Data Protection Regulation (GDPR), which governs data privacy and protection within the European Union. Organizations facing such threats must prioritize the immediate invalidation of any credentials or access keys that may have been leaked to mitigate the risk of identity theft and targeted phishing attempts.

Reports suggesting that the Funksec group utilizes AI-powered tools may indicate a high level of automation in their attack methodology, which can allow for faster and more efficient scanning and exfiltration processes. In the education sector, where networks are often vast and decentralized to accommodate many users, maintaining robust monitoring and rapid incident response capabilities is essential to defend against such automated threats.