Gitlabs: Next TI, VISEO, and Hochschule Trier targeted by fog ransomware group

• Ransomware group: fog
• Sector: Education
• Announcement date: February 19, 2025

The threat actor group known as fog has announced the leak of data allegedly belonging to Next TI, VISEO, and Hochschule Trier. This announcement, made on a ransomware leak site, suggests a significant data breach affecting multiple entities within the education sector.

The claims made by fog

On February 19, 2025, the fog group published a post claiming to have obtained data from the aforementioned entities. This announcement marks a new development in the group's activity, although information regarding this specific group remains limited in the public domain. The group's methods typically involve claiming responsibility for an attack and subsequently posting data to a leak site to pressure victims, a tactic often associated with double extortion ransomware campaigns.

In such scenarios, threat actors often employ double extortion, where they not only encrypt an organization's systems but also steal sensitive information. The goal is to threaten the public release of this data if a ransom is not paid. While the specific motives and technical details of this particular incident remain unclear due to the limited public information on the fog group, the act of publishing a claim on a leak site is a hallmark of this type of cybercriminal activity.

Details of the alleged data leak

The announcement indicates that 8 GB torrent files are available for each entity. The group claims to have a data set of 8 GB for each of the three institutions involved. However, the listing provides no detailed breakdown of the specific data types contained within these files. The announcement does not specify the exact nature of the information, leaving the contents of the torrent files unknown to the public at this time.

• No specific data types were listed in the announcement.

When ransomware groups release data via torrent files, it often complicates the ability of organizations to quickly assess the scope of the breach. Without a detailed inventory of the stolen files, the victims must undergo extensive forensic investigations to determine whether the leaked information includes operational data, intellectual property, or sensitive personal records.

Potential implications and risks

If the leaked data contains operational information or personal records, it may result in negative impacts for the affected organizations. For Hochschule Trier, as it is located within the European Union, the incident may trigger regulatory processes under GDPR. Such regulatory scrutiny often follows the discovery of a data breach involving personal information, requiring organizations to comply with strict notification and reporting standards.

Beyond regulatory consequences, secondary risks could emerge, such as identity theft or targeted phishing campaigns against students and customers. When personal data is exposed, it can be leveraged by other malicious actors to conduct social engineering attacks, further complicating the recovery process for the victimized institutions. Furthermore, the public disclosure of this data might lead to significant reputational damage for the involved parties.

To mitigate such risks, organizations in the education and technology sectors typically prioritize robust defensive measures. Common steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for staff and students. Additionally, maintaining offline, immutable backups is a critical component of a modern cybersecurity posture to defend against the encryption phase of ransomware attacks.