GDLockerSec ransomware group lists www.usmba.ac.ma on its leak site

• Ransomware group: GDLockerSec
• Country: Morocco
• Sector: Education
• Announcement date: January 24, 2025

GDLockerSec claims data breach at Sidi Mohamed Ben Abdellah University

The threat actor group known as GDLockerSec has listed a data set on its leak site that allegedly belongs to Sidi Mohamed Ben Abdellah University. This announcement, which appeared on January 24, 2025, marks a new incident involving the Moroccan educational sector. While the group has published a claim of theft, the incident highlights the ongoing risks faced by academic institutions in the digital age.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat actors then threaten to leak this stolen information on public forums or dedicated leak sites if a ransom is not paid. This tactic increases the pressure on organizations, as the exposure of private data can lead to significant reputational damage and legal consequences.

Details of the claimed attack

According to the announcement made on January 24, 2025, the GDLockerSec group claims to have obtained data from the institution on the same day the listing appeared. The group has published a file totaling 8MB as part of their claim. While the specific contents of the stolen information remain unclear, the provided screenshot from the leak site shows an interface that suggests the data may be in a CSV format.

At this stage, there is no clear information regarding the specific content of the allegedly leaked data. The presence of a CSV viewing interface in the provided materials indicates the format, but the actual data points contained within the file have not been explicitly detailed by the threat actor. Furthermore, no ransom demand has been publicly specified in the current listing.

The target organization

Sidi Mohamed Ben Abdellah University is a public university located in Fez, Morocco. The institution serves as a significant hub for higher education and academic research within the region, operating across various academic fields to support the educational needs of the country.

Risk assessment and organizational implications

This incident suggests that the institution's digital assets may have been subjected to unauthorized access. Depending on the nature of the leaked data, there may be a risk of identity theft if academic staff or student information has been exposed. When sensitive personal information is compromised, the impact can extend far beyond the initial breach, affecting the privacy and security of individuals within the academic community.

The listing names no specific data types. However, the potential for identity theft remains a primary concern in such breaches. For organizations in the education sector, maintaining robust cybersecurity postures is essential. This includes implementing strong access controls, conducting regular security audits, and ensuring that data encryption is applied to sensitive information at rest and in transit. Additionally, organizations often need to initiate investigations in accordance with local data protection regulations and notify the affected parties to mitigate harm.

Public information regarding the GDLockerSec group remains limited. Because of this lack of available intelligence, no definitive assessment can be made regarding the specific motivation or the methodology used by the attackers to penetrate the university's systems. In such cases, organizations typically focus on incident response protocols and forensic analysis to determine the extent of the unauthorized access and to harden their defenses against future attempts.