Inc Ransom ransomware group lists stthom.edu on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Education
• Announcement date: September 3, 2025

The Inc Ransom ransomware group has officially listed the University of St. Thomas on its dedicated leak site. According to the announcement made by the threat actor, the group claims to have successfully exfiltrated a significant volume of data from the institution's networks.

Details of the claimed attack

The threat actor known as Inc Ransom added the University of St. Thomas to its leak site on September 3, 2025. The group asserts that they have obtained 1.8 TB of data from the institution's networks and has expressed an intention to release this information publicly. The announcement provided by the group includes various operational details and contact information for certain staff members of the organization.

Inc Ransom is a ransomware group that emerged in mid-2023. This group is known for practicing double extortion, a tactic where attackers not only encrypt an organization's data but also steal sensitive information to use as leverage during ransom negotiations. In such scenarios, if the victim refuses to pay for the decryption key, the attackers threaten to leak the stolen data on public forums or leak sites to pressure the organization into compliance.

Data involved in the incident

The group claims to possess 1.8 TB of data. While the full scope and specific nature of the leaked data remain unspecified by the attackers, the announcement includes screenshots displaying thumbnails of documents. These thumbnails may represent administrative or operational files belonging to the institution.

• The listing names no specific data types.

It is important to note that while the volume of data is claimed, no specific information was provided regarding the total file count or the specific amount of the ransom demand.

The University of St. Thomas

The University of St. Thomas is a private Catholic university located in Houston. Offering a variety of academic programs at the undergraduate and graduate levels, the institution has been operating for over 70 years.

Potential implications and risks

This incident may pose a risk of exposure for student and personnel records. Given that the institution is based in the United States, legal implications under FERPA and relevant state data protection laws could arise. The potential impacts on the institution's operational continuity and reputation may be observed following such an event.

Because Inc Ransom employs double-extortion tactics, there is a possibility that the exfiltrated data could be utilized for secondary attacks or identity theft. In the broader context of cybersecurity, such incidents highlight the ongoing risks faced by educational institutions. When sensitive data is exfiltrated, the threat actors often use it to conduct phishing campaigns, sell the information on the dark web, or engage in further extortion attempts against the organization or its members.

To defend against such threats, organizations in the education sector typically focus on robust defensive strategies. These include implementing multi-factor authentication (MFA) across all systems, maintaining regular and offline backups to ensure operational continuity, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, regular security awareness training for staff and students can help mitigate the risk of initial access through phishing, which is a common entry vector for ransomware groups.