University of Hawaii listed on Noescape ransomware leak site

• Ransomware group: Noescape
• Country: United States
• Sector: Education
• Announcement date: June 20, 2023

Noescape claims data breach at University of Hawaii

The ransomware group known as Noescape has officially listed the University of Hawaii on its leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant volume of data from the institution's systems. This development marks a potential major security incident for the educational institution, as the threat actor has expressed an intention to publish the stolen information.

The incident was reportedly initiated on June 19, 2023, with the public announcement appearing on the group's leak site on June 20, 2023. While the group has made these claims, public information regarding the specific identity and operational details of the Noescape group remains limited. The group's tactics involve listing victims on their platform to pressure organizations into meeting their demands, a method often associated with modern cyber extortion campaigns.

Details of the alleged data theft

The threat actor claims to have obtained a substantial dataset totaling 65 GB in size. Based on screenshots provided by the group, the stolen archive is quite extensive, reportedly containing 121,722 files and 12,021 folders. The group has indicated that they intend to publish this data, which suggests a high level of intent to cause harm through the exposure of sensitive information.

The contents of the alleged leak are described as containing various types of sensitive information. Specifically, the announcement claims the data includes:

• Student personal data
• Corporate documents

The nature of this data suggests that the breach could impact both the administrative functions of the university and the private lives of its constituents. In many ransomware scenarios, such as double extortion, attackers do not just encrypt systems but also steal data to use as leverage, threatening to release it publicly if the ransom is not paid.

About the University of Hawaii

The University of Hawaii is a public university system located in Hawaii. Founded in 1907, it serves as a major educational hub in the region, offering a wide range of academic programs at both the undergraduate and graduate levels.

Potential impact and organizational considerations

The alleged leak of personal data poses significant risks to the individuals involved. For students and staff, the exposure of personal documents can lead to an increased risk of identity theft or the targeting of individuals through sophisticated phishing attacks. When sensitive information is available in the public domain, attackers can use it to craft highly convincing social engineering schemes.

For educational institutions, such breaches can lead to complex legal and regulatory challenges. In the United States, regulations such as the Family Educational Rights and Privacy Act (FERPA) are designed to protect student privacy, and a breach of this nature may result in legal consequences. Furthermore, the institution may be required to fulfill specific data breach notification obligations, ensuring that all affected parties are informed of the compromise.

Beyond the legal and privacy implications, the university faces potential reputational damage and significant disruption to its operational processes. To mitigate such risks, organizations in the education sector typically focus on robust defensive measures. This includes maintaining strict access controls, implementing comprehensive encryption for data at rest and in transit, and conducting regular security awareness training for students and staff to recognize phishing attempts. Additionally, maintaining a strong incident response plan is essential for managing the aftermath of a potential breach and ensuring compliance with privacy regulations.