Inc Ransom claims data breach at broward.edu

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Education
• Announcement date: January 28, 2025

The ransomware group known as Inc Ransom has listed a significant dataset on its leak site, claiming that the information belongs to Broward College. According to the announcement made by the threat actor, the breach involves a substantial volume of data allegedly exfiltrated from the institution's systems.

The claimed attack and event details

The threat actor known as Inc Ransom announced on January 28, 2025, that it has targeted Broward College. While the announcement was made in late January, the group claims that the alleged breach actually occurred much earlier, specifically on December 11, 2024. This timeline suggests that the attackers may have had access to the institution's network for several weeks prior to the public listing of the data.

Ransomware attacks often follow a pattern where attackers gain unauthorized access to a network, move laterally to identify high-value data, and then exfiltrate that information before deploying encryption. The delay between the initial breach and the public announcement is a common tactic used by ransomware groups to increase pressure on the victim organization during negotiations.

Data involved in the alleged leak

The group has provided some metrics regarding the scale of the alleged theft, though specific details regarding the content of the leaked data were not provided. The listing includes a screenshot that provides information on the total file count and the overall size of the dataset. The specific details claimed by the group include:

• Total data size of approximately 63.7 GB
• A total of 75,435 files

The listing names no specific data types or categories of information that were allegedly stolen during the incident.

About Broward College

Broward College is a public higher education institution located in Fort Lauderdale, Florida. It offers a variety of academic programs in fields such as health, science, mathematics, and social behavioral sciences. Established in 1959, the institution provides associate and bachelor's degree opportunities to students in the region.

Analysis and potential implications

Given the double-extortion tactics employed by the Inc Ransom group, the public release of the alleged data could increase the risk of identity theft or targeted phishing for the institution and its students. Double extortion is a strategy where attackers not only encrypt an organization's data but also steal it, threatening to leak it publicly if a ransom is not paid. This approach ensures that even if an organization can restore its systems from backups, the threat of data exposure remains a powerful lever for the attackers.

As an educational institution, the organization may be subject to data privacy obligations under US state laws and regulations such as FERPA. The alleged data breach may negatively impact the institution's operational continuity and reputation. Furthermore, the group's past activities suggest that the leaked data could be exposed more broadly in the future, extending the lifecycle of the threat.

This situation may also create secondary security risks for the institution's supply chain partners. When a central institution is compromised, the interconnected nature of modern academic and administrative networks means that partners and vendors may face increased risks of targeted attacks. Organizations in this sector typically focus on robust access controls, continuous monitoring, and comprehensive data encryption to mitigate these types of risks.