MRC Prion Unit and Institute of Prion Diseases targeted by crypto24

• Ransomware group: crypto24
• Country: United Kingdom
• Sector: Healthcare
• Announcement date: January 24, 2026

Crypto24 claims data leak at MRC Prion Unit and Institute of Prion Diseases

The ransomware group known as crypto24 has published an announcement claiming that the data belonging to the MRC Prion Unit and Institute of Prion Diseases has been compromised. This claim was made on January 24, 2026, and the group asserts that the attack occurred on the same day. While the group has claimed responsibility for the breach, no specific ransom amount has been specified in their announcement.

Details of the claimed attack

According to the post published by crypto24, the organization's data has been successfully targeted. The group has indicated that they intend to release the full set of stolen data once a designated timer expires. This tactic is a common feature of modern ransomware operations, often referred to as double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish the data on a public leak site, the threat actors aim to pressure the victim into paying a ransom to prevent the exposure of their information.

Despite the announcement, the group has not provided any visual evidence, such as screenshots, to substantiate their claims. Furthermore, there is no specific information available regarding the exact types of data that have been targeted or the volume of information involved in the alleged breach.

The target organization

The MRC Prion Unit and Institute of Prion Diseases operates under the umbrella of University College London (UCL). This unit serves as a specialized research center dedicated to the study of prion diseases. The organization's primary mission involves conducting scientific research to better understand the complex mechanisms behind neurodegenerative diseases. Through this work, the institute aims to develop new therapeutic approaches to combat these conditions.

Potential implications and industry risks

This incident involves a claim of a data leak from an institution focused on critical medical research. While the specific nature of the compromised data remains unknown, a leak of this nature could potentially expose sensitive medical research or confidential patient information. Such an event may lead to significant compliance issues regarding UK GDPR regulations, as organizations are required to protect personal and sensitive data under strict legal frameworks.

A successful breach of this type could result in various secondary risks for the institution, including the potential for targeted phishing attacks against researchers or patients, as well as significant reputational damage. For organizations operating within the healthcare and medical research sectors, maintaining robust cybersecurity posture is essential. Common defensive steps for such organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Furthermore, ensuring strict adherence to data protection regulations is vital to mitigate the legal and operational consequences of a potential breach.

• No specific data types were identified in the listing.