Inha University listed on gunra ransomware leak site

• Ransomware group: gunra
• Country: South Korea
• Sector: Education
• Announcement date: December 29, 2025

The threat actor group gunra claims a breach of Inha University

The threat actor group known as gunra has listed Inha University on their leak site, claiming to have obtained a significant amount of data from the institution. According to the announcement made on December 29, 2025, the group alleges they have successfully compromised the organization's systems.

The group claims to have targeted the university and asserts that they have obtained a total of 650 GB of data. The threat actor alleges that they have compromised the institution's main databases to facilitate this theft. To support their claims, the group has provided screenshots that allegedly display MSSQL database exports and various visual proof files.

Details of the alleged data theft

Based on the screenshots provided by the threat actor, the allegedly leaked data includes several types of sensitive information. The content of the leak is reported to include MSSQL database exports, tables containing personal information, and various image files. While the group has provided visual evidence, specific details regarding the exact number of files or the specific ransom demand have not been provided.

The types of data identified in the listing include:

• Personal data
• Database records

Information regarding the gunra group remains limited in the public domain, as there is little available information about their specific operations or identity.

About Inha University

Inha University is a private research university located in Incheon, South Korea. It is a well-established higher education institution known for its strong academic programs in engineering and technology.

Potential impact and organizational risks

The alleged leak may pose a risk of exposure for student and staff data within the university. Under the Personal Information Protection Act (PIPA) in South Korea, the institution may face mandatory data breach notification requirements. The content of the alleged data could potentially be used for identity theft and targeted phishing attacks against the institution's network.

Furthermore, the publication of database contents may damage the institution's operational credibility and lead to secondary extortion attempts. In many ransomware scenarios, threat actors utilize a method known as double extortion, where they not only encrypt an organization's data but also threaten to leak sensitive information on public forums to increase pressure on the victim.

For organizations in the education sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities in database configurations. Protecting large-scale databases, such as the MSSQL instances mentioned in this claim, is critical to preventing the unauthorized extraction of personal and institutional records.