Unimore.it listed on funksec leak site

• Ransomware group: funksec
• Country: Italy
• Sector: Education
• Announcement date: March 12, 2025

The University of Modena and Reggio Emilia listed by funksec

The University of Modena and Reggio Emilia (unimore.it) has been listed on a leak site by a threat actor group known as funksec. The group claims to have successfully targeted the institution, marking a potential significant breach for the Italian academic entity.

Details of the alleged attack

According to the announcement made on March 12, 2025, the funksec group claims to have obtained approximately 1,000 files from the university's intranet system. This group, which first emerged in late 2024, has gained attention for its reported use of artificial intelligence-supported tools to conduct its operations.

The threat actor claims the breach occurred on the same day the announcement was posted, March 12, 2025. While the group has published the organization's name on their leak site, no specific ransom demand has been disclosed in the available information.

Alleged data and affected information

The data allegedly stolen by the threat actors includes a variety of sensitive materials. The group claims to have accessed information related to the U-gov project, as well as various internal documents and financial transactions. The stolen files are said to include secret plans in PDF, DOC, and XLSX formats, along with email messages and phone numbers.

The specific types of data mentioned in the claim include:

• Financial data
• Internal documents
• Email correspondence
• Phone numbers

About the University of Modena and Reggio Emilia

Università degli Studi di Modena e Reggio Emilia (UNIMORE) is a well-established public university located in the cities of Modena and Reggio Emilia, Italy. The institution conducts education and research activities, offering undergraduate and postgraduate programs across various academic disciplines.

Analysis and potential impact

This alleged breach may pose a significant risk of exposure for student and staff data. Given the institution's location in Italy, the incident could trigger regulatory obligations under the GDPR (EU General Data Protection Regulation). The exposure of phone numbers and email addresses may facilitate targeted phishing attacks against university staff and students.

Furthermore, the potential disclosure of financial records and confidential project documents could negatively impact the institution's operational security and academic reputation. The group's reported use of AI-driven tools suggests that these attacks may be conducted with a higher degree of sophistication.

In the broader context of cybersecurity, ransomware leak sites are often used in double extortion schemes. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly to pressure the victim into paying a ransom. For educational institutions, which manage vast amounts of personal, financial, and research data, such threats can be particularly damaging to both privacy and institutional integrity.

Organizations in the education sector often face unique challenges due to the decentralized nature of academic networks and the high volume of transient users. To mitigate such risks, institutions typically focus on robust identity and access management, regular security awareness training for students and staff, and comprehensive monitoring of internal systems to detect unauthorized access to sensitive intranets or project files.