Istituto di Istruzione Superiore "Giulio Natta" targeted by ElDorado ransomware group

• Ransomware group: ElDorado
• Country: Italy
• Sector: Education
• Announcement date: November 18, 2024

The ElDorado ransomware group has claimed responsibility for a cyberattack against the Istituto di Istruzione Superiore "Giulio Natta". According to an announcement posted on the group's leak site on November 18, 2024, the threat actors allege that they have successfully compromised the institution's networks and exfiltrated data.

The details of the claim

The threat actor, identified as the ElDorado group, listed the Italian educational institution on its dedicated leak site on November 18, 2024. The group alleges that they gained unauthorized access to the organization's internal networks. Through this access, the attackers claim to have exfiltrated sensitive information from the institution's systems.

Information regarding the specific identity, motivations, or technical methods of the ElDorado group remains limited. In the landscape of modern cybercrime, ransomware groups often utilize a tactic known as double extortion. This method involves not only encrypting an organization's files to disrupt operations but also stealing sensitive data to use as leverage. By threatening to release stolen information on public leak sites, attackers increase the pressure on organizations to meet ransom demands.

Data involved in the incident

At this stage, the listing provides no specific details regarding the nature of the alleged leaked data. No screenshots or samples of the data have been provided by the threat actor to verify the claims. Furthermore, the announcement does not specify the volume of files or the total size of the data that was purportedly stolen.

• No specific data types were named in the listing.

About the organization

The Istituto di Istruzione Superiore "Giulio Natta" is a secondary education institution located in Bergamo, Italy. The school focuses on providing technical and vocational training to its students. Its primary mission is to equip students with various academic and professional skills across several technical fields, preparing them for specialized roles in the workforce.

Potential impact and organizational implications

The potential exposure of institutional data carries significant risks for the affected parties. If the claims are accurate, the disclosure of sensitive information could lead to the exposure of student and staff details. Such a breach increases the risk of identity theft and makes individuals within the institution more vulnerable to targeted phishing attacks. These social engineering attempts often use stolen personal information to gain further access to systems or to defraud individuals.

Because the institution operates within Italy, this incident may result in data protection compliance issues under the General Data Protection Regulation (GDPR). Organizations facing such threats often deal with operational disruptions and significant reputational damage following a public claim of a breach. To defend against such threats, organizations in the education sector typically implement defensive measures such as multi-factor authentication, regular security awareness training, and robust network segmentation to limit the lateral movement of attackers.