itca.edu.sv listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: El Salvador
• Sector: Education
• Announcement date: December 25, 2024

The safepay group claims a breach of itca.edu.sv

The educational institution itca.edu.sv has been listed on the leak site by the safepay group. This announcement, which appeared on the group's platform on December 25, 2024, follows a claim that the group successfully gained access to the institution's internal systems.

According to the claims made by the threat actor, the organization was subjected to an attack on December 21, 2024. The group's announcement serves as a notification of the alleged breach, though the specific details surrounding the intrusion remain limited to the information provided by the attackers themselves.

Details regarding the alleged data leak

At this stage, no information has been provided regarding the nature of the data allegedly leaked during the incident. The listing does not specify the types of files or the categories of information that the group claims to have exfiltrated from the institution's network.

Furthermore, as there is no screenshot available to support the claim, the scope of the shared data cannot be verified. The listing names no data types.

About ITCA-FEPADE

ITCA-FEPADE (Escuela Especializada en Ingeniería ITCA-FEPADE) is a higher education institution based in El Salvador. The organization specializes in technical and engineering fields, offering various educational programs that are specifically focused on applied sciences and technology.

Analysis and potential impact of the attack

The safepay group is described as an entity that emerged in late 2024. This group employs double extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also threaten to leak sensitive information on public forums to pressure the victim into paying a ransom.

The publication of the institution's data may lead to the exposure of student and staff information. Such a leak could potentially result in identity theft and targeted phishing attacks against the individuals involved. Given the data privacy standards typically found in the education sector, the incident could result in negative impacts on the institution's operational processes.

It is noted that the safepay group does not use an affiliate program, which may suggest that the group maintains its own operational discipline. In general, organizations facing such threats often focus on strengthening their defensive posture through various means, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access.

Summary of the threat actor profile

• Group name: safepay
• Tactics: Double extortion
• Affiliate program: None
• Emergence: Late 2024