UF Resources listed on NoEscape ransomware leak site

• Ransomware group: NoEscape
• Country: United States
• Sector: Professional Services
• Announcement date: December 4, 2023

NoEscape claims breach of UF Resources

The ransomware group known as NoEscape has listed UF Resources on its dedicated leak site, claiming to have successfully compromised the organization's network. According to the announcement made on the group's platform, the threat actors allege that they have gained unauthorized access to the systems and have encrypted the organization's data.

The incident was reportedly initiated on November 26, 2023. The group's post indicates a double extortion tactic, a common method used by modern ransomware operators where data is both encrypted to disrupt operations and stolen to be used as leverage. In this specific instance, the group has threatened to release the stolen information publicly if the organization fails to comply with their demands. While the specific ransom demand has not been disclosed, the threat of a public data leak remains a central component of the group's pressure tactics.

Details of the alleged data theft

The threat actor claims to have exfiltrated a significant amount of sensitive information. The group alleges that the total volume of stolen data amounts to 10 GB, consisting of approximately 6,000 files. The breadth of the data types mentioned in the leak site post suggests a deep penetration into the organization's digital environment, targeting various administrative and personal records.

According to the claims made by NoEscape, the stolen data includes the following categories of information:

• Employee personal data
• Financial data
• Health records
• Identity documents
• Accounting data

More specifically, the group alleges that the stolen files contain highly sensitive items such as employee personal information, driver's licenses, Social Security Numbers (SSN), drug test results, job applications, insurance ID cards, HIPAA documents, birth certificates, passports, credit card information, confidential reports, invoices, sales and order records, accounting information, payroll and HR data, and vendor information.

About UF Resources

UF Resources is an organization operating within the University of Florida. It serves as a centralized support hub, providing essential services across multiple administrative domains. The organization's responsibilities include managing and supporting areas such as finance, accounting, human resources, information technology, sales, and marketing for the university's broader operations.

Potential impact and risks

The alleged breach of UF Resources carries significant implications for both the organization and the individuals whose data is involved. The presence of highly sensitive information, such as Social Security Numbers, passports, and birth certificates, significantly increases the risk of identity theft and fraud for employees and customers. Furthermore, the inclusion of HIPAA documents and personal health information introduces potential regulatory compliance challenges under United States law, as these types of data are strictly protected by privacy frameworks.

From an operational standpoint, the reported encryption of systems suggests that the organization's ability to maintain continuity may be compromised. Such disruptions can affect the delivery of centralized services like payroll, human resources, and information technology. Additionally, there is a secondary risk that the leaked data could be utilized by the threat actors or other malicious parties in targeted phishing campaigns, using the stolen details to gain further access or deceive individuals.

In the broader context of cybersecurity, ransomware attacks like the one claimed by NoEscape highlight the ongoing challenges faced by professional service providers. When organizations handle sensitive administrative and financial data, they become high-value targets. To mitigate such risks, organizations typically focus on robust defensive strategies, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.