HE2B listed on fog ransomware leak site

• Ransomware group: fog
• Country: Belgium
• Sector: Healthcare
• Announcement date: February 4, 2025

HE2B listed on fog ransomware leak site

The Belgian institution HE2B has been listed on the leak site of the ransomware group known as fog. According to the announcement made on February 4, 2025, the threat actor claims to have targeted the organization, which operates within the education and healthcare sectors. The breach is characterized as a data leak rather than a simple encryption event, a common tactic in modern cyberattacks.

The claims of the fog ransomware group

The threat actor identified as fog has published information claiming that the institution's data has been compromised. Specifically, the announcement states that GitLab source codes belonging to HE2B have been leaked. The group claims that this data has been made available for download via a 1 GB torrent file. While the group has taken credit for the attack, public information regarding the specific identity and background of this group remains limited in the public domain.

In many modern ransomware campaigns, threat actors employ a strategy known as double extortion. In this scenario, attackers do not just encrypt an organization's files to demand a ransom for decryption; they also steal sensitive data and threaten to leak it on public platforms if the ransom is not paid. This adds significant pressure on the victim, as the exposure of data can cause long-term reputational and legal damage even if the systems are successfully restored from backups.

Affected data types

The listing identifies the following as the data involved in the alleged leak:

• Source codes

About HE2B

HE2B (Haute École Bruxelles-Brabant) is a higher education institution located in the Brussels region of Belgium. The institution provides various undergraduate and graduate degree programs across several academic fields, including healthcare, technology, economics, and pedagogy.

Potential implications and organizational risks

The alleged leak of source code carries significant technical and operational risks. From a security perspective, the exposure of an organization's source code may provide a foundation for further sophisticated attacks against the institution's digital infrastructure. When attackers gain access to the underlying logic of software, they can more easily identify and exploit security vulnerabilities, potentially leading to unauthorized access or further system compromises by third parties.

Beyond the technical risks, there are substantial legal and administrative considerations. As HE2B operates within Belgium, any breach involving sensitive information may result in legal and administrative consequences under the EU General Data Protection Regulation (GDPR). Furthermore, such a leak could undermine the institution's operational credibility and increase the risk of recurring attacks from different threat actors.

To mitigate these risks, organizations in the education and healthcare sectors often implement several defensive measures. These include robust access controls to protect development environments, regular security audits of codebases, and comprehensive monitoring of network traffic to detect unauthorized data transfers. Additionally, maintaining a strong incident response plan and ensuring that sensitive data is encrypted both at rest and in transit are standard practices to reduce the impact of potential leaks.