St. Thomas Aquinas High School targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Education
• Announcement date: July 31, 2024

Medusa ransomware group claims data breach at St. Thomas Aquinas High School

The Medusa ransomware group has officially listed St. Thomas Aquinas High School on its dedicated leak site. According to the announcement made on July 31, 2024, the threat actors claim to have successfully infiltrated the institution's network. The group alleges that they have obtained a significant amount of data, which they intend to use as leverage in a potential extortion attempt.

Details of the alleged attack and claims

The incident, which the group claims began on July 30, 2024, involves a purported breach of the educational institution's digital infrastructure. The Medusa group has asserted that they have exfiltrated approximately 103.8 GB of data from the school's systems. While the group has moved to list the organization on their leak site, they have not provided specific details regarding the exact nature or the specific categories of the files they claim to possess.

This type of activity is characteristic of a double extortion tactic. In such a scenario, ransomware actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption occurs. The threat actors then use the threat of leaking this stolen data on their public leak site to pressure the victim into paying a ransom. By making the data public, the attackers increase the pressure on the organization to comply with their demands to prevent reputational damage or legal repercussions.

Data involved in the claim

Regarding the specific content of the alleged breach, the group has not provided detailed information. The only evidence currently available is a screenshot from the leak site, which merely displays a human verification captcha required to access the site's content. Consequently, the listing does not name any specific data types or individual files that have been compromised.

About St. Thomas Aquinas High School

St. Thomas Aquinas High School is a private Roman Catholic high school located in Fort Lauderdale, Florida. Founded in 1936, the school provides college-preparatory education to its students.

Potential risks and implications for educational institutions

This alleged breach poses significant risks to the privacy of the sensitive data held by the educational institution, particularly concerning the personal information of students and staff members. Because the institution operates within the United States, a confirmed data breach could trigger complex legal obligations under the Family Educational Rights and Privacy Act (FERPA) as well as various relevant state laws regarding data protection and notification requirements.

The use of double extortion by groups like Medusa—a Ransomware-as-a-Service (RaaS) group that has been active since 2021—introduces secondary risks. Even if an organization manages to restore its systems from backups, the threat of the public release of sensitive data or the sale of that data to third parties remains a persistent danger. This can lead to long-term consequences such as identity theft or highly targeted phishing attacks directed at the school's stakeholders.

For organizations in the education sector, maintaining vigilance is critical. To mitigate the risks associated with such attacks, institutions often focus on robust defensive measures. These include implementing multi-factor authentication, maintaining regular and offline backups, and conducting comprehensive employee training to recognize social engineering attempts. Stakeholders should remain alert to potential follow-on attacks that may exploit any information that might eventually surface from such breaches.