Lockbit3 ransomware group lists vuu.edu on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Education
• Announcement date: February 21, 2023

The educational institution Virginia Union University (vuu.edu) has been listed on the leak site of the LockBit ransomware group. This listing, appearing on February 21, 2023, serves as an announcement of a claimed data breach involving the university's systems.

The claimed attack and event details

The LockBit group officially listed vuu.edu on their dedicated leak site on February 21, 2023. Through this announcement, the group claims to have successfully carried out a data breach against the institution. According to the group's allegations, they have gained unauthorized access to the university's internal systems and have acquired data from these environments.

While the listing is presented as a claim by the threat actor, it strongly suggests that the institution may have been the target of a ransomware attack. Ransomware attacks often involve a process where attackers infiltrate a network, escalate privileges, and eventually deploy encryption or exfiltrate data to use as leverage. When a group lists a victim on a leak site, it is a common tactic used to pressure the organization into meeting specific demands, often through a method known as double extortion.

In double extortion scenarios, attackers not only encrypt the victim's data to disrupt operations but also steal sensitive information. They then threaten to publish this stolen data on public leak sites if the ransom is not paid. This tactic increases the pressure on the victim, as the threat of public exposure can cause significant reputational and legal damage, regardless of whether the organization can restore its systems from backups.

Information regarding the leaked data

At this time, there is no screenshot or detailed information available regarding the nature of the leaked data. The listing does not specify the types of files, the volume of data, or the specific databases that were allegedly accessed. Consequently, the listing names no specific data types.

About Virginia Union University

Virginia Union University is a private historically black Baptist university located in Richmond, Virginia. The institution is affiliated with the American Baptist Churches USA.

Analysis and implications for the sector

This incident may pose a risk of sensitive data exposure or extortion for the institution. For an educational institution, the leakage of student and staff records could lead to identity theft and targeted phishing attacks. Such attacks often target individuals within the academic community to gain further access to institutional networks or to commit financial fraud.

Because the institution operates in the United States, data protection obligations under the Family Educational Rights and Privacy Act (FERPA) or relevant state laws may be applicable. These regulations require institutions to implement strict safeguards to protect student educational records and personal information.

The LockBit group is a Ransomware-as-a-Service (RaaS) entity that has been tracked since 2019. Despite experiencing operational disruptions in February 2024, the group may continue to be active. This highlights the persistent nature of RaaS models, where developers provide the ransomware code to affiliates who carry out the actual attacks.

To mitigate these risks, organizations in the education sector may need to review their data security protocols and take measures against potential secondary attacks. Common defensive steps for organizations facing such threats include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for staff and students to prevent initial access through phishing.