Regina Coeli Convent listed on incransom leak site

• Ransomware group: incransom
• Country: United States
• Sector: Education
• Announcement date: January 17, 2025

A data breach claim against Regina Coeli Convent

The ransomware group known as incransom has listed the Regina Coeli Convent on its dedicated leak site. This announcement, which appeared on January 17, 2025, constitutes a claim of a data breach by the threat actor. The group has published a series of documents that they allege belong to the institution, signaling a potential compromise of organizational data.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. These sites are used to host stolen data, which the attackers threaten to release unless a ransom is paid. This tactic is a central component of modern cyber extortion, where the goal is not just to encrypt systems, but to weaponize the sensitive information gathered during the intrusion.

Details of the claimed incident

According to the announcement made by incransom on January 17, 2025, the group has added the organization to its list of victims. The threat actor claims to have successfully exfiltrated data from the institution. While the group has published various document samples to support their claim, no specific information was provided regarding the total volume of data stolen or the specific number of files involved in the breach. Furthermore, no ransom demand has been made public in the current listing.

The published materials include information regarding the institution's operations. Based on the available evidence, the content appears to consist of various official documents and forms that seem to be related to the administrative and operational processes of the organization. The presence of these documents on a public leak site is a common indicator of a successful data exfiltration phase during a cyberattack.

Affected data types

• Administrative documents
• Operational forms

About Regina Coeli Convent

Regina Coeli Convent is an organization based in the United States, specifically operating within the state of Louisiana. The institution provides early childhood education services across five different parishes. It plays a significant role in the local community by providing educational and developmental support to over 1,800 children.

Analysis and implications for the education sector

The incransom group is known for employing double-extortion tactics. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. The publication of allegedly exfiltrated data can lead to significant operational and reputational damage for the targeted institution. For an organization like Regina Coeli Convent, which operates in the education sector, the consequences of such a breach can be multifaceted.

If the breach involves records pertaining to students or employees, the institution may face legal obligations under United States state laws and relevant data protection regulations. The sensitivity of the shared documents increases the risk of identity theft or targeted phishing attacks directed at the institution's staff and the families they serve. Such attacks often exploit the trust inherent in educational environments to further the attackers' goals.

Given the history of the incransom group, there is a possibility of secondary extortion attempts or the sale of the stolen data to third parties on the dark web. To mitigate such risks, organizations in the education sector typically focus on strengthening their defensive posture. This includes implementing robust access controls, maintaining regular offline backups, and conducting employee training to recognize phishing attempts. Ensuring that data is encrypted both at rest and in transit is also a fundamental step in protecting sensitive information from unauthorized access and exfiltration.