RansomHub ransomware group lists www.iiitd.ac.in on its leak site

• Ransomware group: RansomHub
• Country: India
• Sector: Education
• Announcement date: August 30, 2024

RansomHub claims a data breach at IIIT-Delhi

The RansomHub ransomware group has published a listing on its dedicated leak site claiming responsibility for a cyberattack against the Indraprastha Institute of Information Technology, Delhi (IIIT-Delhi). According to the announcement made on August 30, 2024, the threat actor group alleges that they have successfully compromised the institution's systems and exfiltrated a significant volume of sensitive information.

The group's claim suggests that the breach occurred around August 22, 2024. While the total size of the stolen data has not been specified by the attackers, they have provided a file count, claiming that a total of 171,857 files have been exfiltrated from the academic institution's network.

Details of the alleged data exfiltration

The RansomHub group has provided evidence to support their claims by publishing screenshots that purportedly contain samples of the stolen documentation. These samples indicate that the breach involves a wide range of sensitive administrative and personal information. The leaked content is said to include institutional budget reports, student records, bank account details, and various legal documents.

Based on the information provided by the threat actor, the following types of data are allegedly involved in the leak:

• Student personal data
• Bank account details
• Employee identification documents
• Institutional budget reports
• Non-disclosure agreements

The exposure of such diverse data types—ranging from personal student information to sensitive financial and legal documents—highlights the broad scope of the alleged compromise. The presence of non-disclosure agreements (NDAs) suggests that the breach may also impact third-party relationships involving the institution.

About the Indraprastha Institute of Information Technology, Delhi

The Indraprastha Institute of Information Technology, Delhi (IIIT-Delhi) is a prestigious academic and research institution located in New Delhi, India. Established in 2008, the institute offers undergraduate, postgraduate, and doctoral programs in information technology and related fields.

Potential impact and security implications

If the claims made by RansomHub are verified, the breach could have significant consequences for both the institution and the individuals involved. For students and staff, the exposure of personal data and identification documents increases the risk of identity theft and targeted phishing attacks. Furthermore, the leak of institutional budget and banking information could lead to secondary risks regarding the institution's financial operations.

From a regulatory perspective, the institution may face legal obligations under Indian data protection regulations due to the exposure of sensitive personal and financial information. Such incidents often result in significant reputational damage and operational disruptions for educational institutions.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It was reported to have absorbed former affiliates from the ALPHV group and was said to have ceased operations in early 2025. This type of threat actor typically employs double extortion tactics, where data is not only encrypted but also stolen to be used for blackmail on leak sites.

To defend against such threats, organizations in the education sector can implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication (MFA) across all services, and conducting regular security awareness training for students and staff to recognize phishing attempts. Additionally, monitoring network traffic for unusual data exfiltration patterns can help in the early detection of such incidents.