IFPA listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Brazil
• Sector: Education
• Announcement date: July 26, 2023

ALPHV claims IFPA data breach after ignored ransom demands

The Federal Institute of Pará (IFPA), a public educational institution based in Brazil, has been listed on the leak site of the ALPHV ransomware group. According to the announcement made on July 26, 2023, the threat actors claim that the institution has ignored their ransom demands. As a consequence of this alleged non-compliance, the group has stated that they will proceed to publish the personal data of both employees and students. Furthermore, the group has declared that the stolen information will be put up for sale on the dark web.

The threat actors have provided evidence to support their claims by posting screenshots that appear to display the internal file structure of the institution. These images provide a glimpse into the organization's digital environment, suggesting that the attackers have gained access to sensitive internal directories. While the exact date of the initial attack is claimed to be January 21, 2023, the group's announcement serves as a direct threat to the institution's privacy and data integrity.

Details of the alleged data theft

The screenshots provided by the ALPHV group show various folder structures that appear to belong to critical administrative and academic units. These directories suggest that the breach may have compromised a wide range of institutional information. Based on the visual evidence provided by the attackers, the following types of data are reportedly involved in the breach:

• Employee data
• Student data
• Administrative documents
• Contracts

The presence of these specific file structures indicates that the breach likely spans multiple departments, from human resources and personnel records to academic processes and legal/contractual documentation. The group's intent to sell this data highlights the high value placed on institutional and personal information by modern ransomware syndicates.

About the Federal Institute of Pará

The Federal Institute of Pará (IFPA) is a public educational institution located in the state of Pará, Brazil. The organization plays a significant role in the region's academic landscape, offering a variety of programs including technical, undergraduate, and postgraduate studies. The institution operates through 18 different campuses, serving a broad demographic of students and staff across the state.

Impact and risks of the alleged leak

The alleged leak of information poses significant risks to the individuals whose data is contained within the institution's systems. The exposure of student and staff personal information can lead to severe consequences, including identity theft and the execution of highly targeted phishing attacks. Such attacks often leverage stolen personal details to gain further access to systems or to defraud individuals through social engineering.

For a public entity like IFPA, the implications extend beyond individual privacy. The breach could result in significant negative impacts on public trust and the overall reputation of the institution. Furthermore, under Brazil's General Data Protection Law (LGPD), such a data exposure could potentially lead to legal processes and administrative sanctions for the institution.

The ALPHV group, also known as BlackCat, is a sophisticated ransomware entity known for utilizing Rust-based malware. This group frequently employs double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to leak it publicly unless a ransom is paid. This dual pressure significantly increases the impact of the attack on the victim organization.

In the face of such threats, organizations in the education sector often focus on strengthening their defensive postures. Common defensive strategies include implementing robust multi-factor authentication, maintaining regular and offline backups, and conducting regular security awareness training for staff and students. Protecting sensitive administrative and academic data is essential for maintaining institutional integrity and ensuring compliance with regional data protection regulations.