GO! Handelsschool Aalst listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Belgium
• Sector: Education
• Announcement date: November 2, 2023

Rhysida claims data breach at GO! Handelsschool Aalst

The Rhysida ransomware group has listed the Belgian educational institution GO! Handelsschool Aalst on its dedicated leak site. This announcement, made on November 2, 2023, indicates a potential data breach involving the organization. The threat actor claims to have successfully exfiltrated a significant volume of data from the institution's systems.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. These sites are used to host stolen data or announcements of impending leaks to coerce organizations into paying ransoms. When a group lists a target, it often signals that negotiations have failed or that the attackers are moving directly to the extortion phase of their operation.

Details of the claimed theft

According to the claims made by the Rhysida group, the breach involves a substantial amount of information. The threat actor asserts that the compromised dataset consists of 114 GB of data. This stolen information is reported to include a total of 218,811 files. The group published this information on November 2, 2023, the same day they claimed the attack occurred.

The group appears to be employing a double extortion strategy. In a double extortion scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data before encryption. They then threaten to leak this data on public forums or leak sites if the ransom is not paid. This tactic increases the pressure on the victim, as the threat of a public data leak can cause significant reputational and regulatory damage, regardless of whether the organization can restore its systems from backups.

The listing does not provide specific details regarding the exact content of the leaked data. However, it is possible that the files contain student and staff information related to the institution's educational activities.

About GO! Handelsschool Aalst

GO! Handelsschool Aalst is an educational institution located in Aalst, Belgium. The school aims to provide personalized education to its students. Furthermore, the institution promotes an environmentally conscious approach within an open learning atmosphere.

Implications and sector risks

The targeting of the education sector by the Rhysida group poses a significant risk regarding the exposure of personal data belonging to students and educational staff. For an institution operating within Belgium, such a breach may trigger obligations under the General Data Protection Regulation (GDPR). Failure to protect sensitive personal information can lead to potential regulatory sanctions and legal consequences for the organization.

The leaked data, if made public, could be exploited by malicious actors for various purposes, such as identity theft or highly targeted phishing attacks. Phishing attacks often leverage stolen personal details to appear legitimate, making it easier for attackers to deceive individuals into revealing even more sensitive information or credentials.

Rhysida, which emerged in 2023, is known for utilizing these double extortion tactics, which can threaten the operational continuity of targeted organizations. To defend against such threats, organizations in the education sector can implement several defensive measures. These include maintaining robust, offline backups to ensure operational continuity, implementing multi-factor authentication (MFA) across all systems, and conducting regular security awareness training for staff and students to recognize phishing attempts. Additionally, maintaining strict access controls and monitoring network traffic for unusual activity can help in detecting and mitigating potential breaches before large amounts of data can be exfiltrated.