Stormous ransomware group lists uatf.edu.bo on its leak site

• Ransomware group: Stormous
• Country: Bolivia
• Sector: Education
• Announcement date: November 17, 2024

Stormous claims a data breach at Universidad Autónoma Tomás Frías

The ransomware group known as Stormous has announced the alleged leak of data belonging to the Universidad Autónoma Tomás Frías (UATF) on its dedicated leak site. According to the announcement, the threat actor claims to have successfully breached the institution's systems and obtained various files. This announcement was published on the group's platform on November 17, 2024, following an alleged attack that took place on November 16, 2024.

The group's claim involves a breach of the university's digital infrastructure, suggesting that unauthorized access was gained to sensitive internal environments. While the group has listed the institution on its leak site, the specific details regarding the volume of data or the specific ransom demand have not been provided in the public announcement.

Details of the alleged data theft

The information provided by the threat actor suggests that the breach involves a variety of sensitive files. The group claims to have accessed directories containing personal information and internal communications. Based on the screenshots provided by the attackers, the leaked content is said to include:

• Student personal data, such as addresses and phone numbers
• Internal correspondence between employees and students

The visual evidence shared by the group displays various file directories and a list of files with email extensions, indicating that the scope of the breach may extend to communications and organizational structures within the university.

About Universidad Autónoma Tomás Frías

Universidad Autónoma Tomás Frías (UATF) is a public university located in Potosí, Bolivia. It is an established higher education institution that offers various undergraduate and postgraduate programs to its student body.

Analysis and implications of the incident

This alleged leak may increase the risk of identity theft or targeted phishing attacks against students and staff within the institution. When sensitive personal data is exposed, individuals often become targets for social engineering tactics where attackers use stolen information to gain further trust or access to other accounts.

Risks to the institution

The exposure of sensitive data held by educational institutions could damage the organization's reputation and potentially trigger legal processes under local data protection regulations. Educational institutions often manage vast amounts of personal information, making them attractive targets for cybercriminals seeking to exploit identity data or disrupt academic operations.

Background on the threat actor

The Stormous group, which has been active since 2021, is known to claim political motivations for its actions. This group is recognized for its tendency to combine data leaks with ransom demands, a tactic often referred to as double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release the stolen information publicly to pressure the victim into paying a ransom.

Recommended defensive measures

For organizations facing similar threats, it is generally advisable to conduct a comprehensive forensic investigation to determine the full scope of the leaked data and to notify the affected parties. Strengthening security postures through regular audits, implementing multi-factor authentication, and maintaining robust backup strategies are common defensive steps used to mitigate the impact of such breaches. Furthermore, monitoring for unauthorized access and enhancing employee awareness regarding phishing can help reduce the likelihood of successful initial intrusions.