North American University listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Education
• Announcement date: January 29, 2024

Inc Ransom claims data breach at North American University

The threat actor known as Inc Ransom has listed North American University on its leak site, claiming to have obtained institutional data. This announcement, made on January 29, 2024, suggests that the group has successfully targeted the higher education institution and is now moving forward with its extortion tactics by publishing information online.

According to the claims made by the group, the incident involves the publication of various archive files that allegedly belong to the university. The threat actor's announcement indicates that the breach may involve significant amounts of administrative and academic data. While the group has listed the organization on its leak site, the specific details regarding the total volume of data or the exact number of files involved remain undisclosed by the attackers.

Details of the claimed data leak

The information provided by the threat actor suggests that a wide range of sensitive institutional files may have been compromised. Based on the file names identified in the screenshots provided by the group, the leaked data is claimed to include several categories of sensitive information. These categories suggest that the breach may impact various administrative, academic, and financial departments within the institution.

The specific types of data claimed to be involved in this leak include:

• Student records
• Admissions data
• Human resources data
• Financial aid information
• Teacher certification records

The presence of such diverse data types highlights the potential breadth of the unauthorized access claimed by Inc Ransom. The group's use of double-extortion tactics—a method where attackers not only encrypt an organization's systems but also threaten to release sensitive data to pressure the victim into paying a ransom—is a common strategy used to increase leverage during negotiations.

About North American University

North American University is a private, non-profit higher education institution located in Houston, Texas. The university offers baccalaureate degree programs across various disciplines, serving a diverse student body through its academic offerings in the United States.

Implications and sector-wide risks

This incident may compromise the privacy of student and staff data at North American University. Given the sensitive nature of the leaked data, there is a potential risk of identity theft and targeted phishing attacks for the individuals whose information has been affected. The education sector is frequently targeted in such attacks due to the high volume of sensitive personal information it maintains, making it an attractive target for cybercriminals seeking valuable data.

As an institution operating in the United States, this incident may have legal implications under state-level data protection laws and regulations, such as the Family Educational Rights and Privacy Act (FERPA). The publication of data by the Inc Ransom group may weaken the institution's operational security and reputation. For organizations in the education sector, such incidents underscore the importance of robust cybersecurity frameworks and proactive data protection measures to mitigate the risks of data exfiltration and subsequent extortion.