Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. targeted by fog

• Ransomware group: fog
• Sector: Education
• Announcement date: February 9, 2025

The threat actor known as fog has listed Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, and iRidge Inc. on its leak site, claiming to have exfiltrated their data. This announcement, made on February 9, 2025, marks a new development in the activities of the group, which remains relatively obscure in the public domain.

The claims made by the fog group

On February 9, 2025, the fog group announced that it had compromised the aforementioned three organizations. The group's post includes torrent links for data sets, which are intended to facilitate the distribution of the stolen information. While the group has made these claims, information regarding this specific group is limited in the public domain, making it difficult to ascertain their full operational profile or long-term objectives.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release this information publicly, the attackers aim to pressure the victim into paying a ransom to prevent the data from being exposed. This tactic increases the pressure on the target, as the consequences of a leak often extend far beyond immediate operational downtime.

Details regarding the claimed data

The group has provided specific claims regarding the volume of data they have allegedly obtained. According to the announcement, each of the three organizations has had approximately 7 GB of data leaked. However, the group has not provided specific details regarding the nature of the exfiltrated data. The listing names no specific data types.

When data is exfiltrated, the impact is often determined by the sensitivity of the information. While the group has not specified the content, the presence of large data sets on a leak site presents a significant risk. In many modern cyberattacks, the goal is to acquire high-value information that can be used for further malicious activities or to maximize the leverage held over the victim organization.

Potential implications and organizational risks

The potential leakage of data from these organizations may negatively impact their operational continuity and reputation. If the leaked data contains employee or customer information, it may be exploited for identity theft or targeted phishing campaigns. Furthermore, it is possible that these incidents could create secondary risks for the organizations' supply chain partners, as the compromise of one entity can often lead to vulnerabilities in its interconnected business network.

The threat actor's decision to release the data publicly increases the likelihood that the information may be misused by malicious third parties. Once data is available on a leak site or via torrent links, it can be downloaded and distributed by anyone, making it nearly impossible to fully contain the breach. This public exposure significantly heightens the risk of the data being used in subsequent, coordinated attacks against the same or related targets.

Risk assessment and defensive considerations

From a regulatory perspective, the leakage of sensitive information can trigger legal processes under local data protection regulations, such as the EU GDPR. Organizations facing such incidents must often navigate complex compliance requirements regarding notification and remediation. The impact of a breach can be multifaceted, affecting not just the immediate technical infrastructure but also the legal and financial standing of the institution.

To mitigate such risks, organizations typically focus on several defensive layers. Implementing robust access controls and multi-factor authentication can help prevent unauthorized entry. Regular monitoring of network traffic can assist in detecting exfiltration attempts before large volumes of data are moved. Furthermore, maintaining a strong security posture through regular patching and employee training is essential to defend against the evolving tactics used by ransomware groups like fog.