Data breach at VCUarts Qatar claimed by Dispossessor ransomware gang

Virginia Commonwealth University School of the Arts Qatar this week notified an undisclosed number of people about a July 2024 data breach that compromised names, dates of birth, email addresses, addresses, phone numbers, nationalities, and more. The info also includes the nature of products or services provided to VCUQ and the amount VCUQ paid for them, plus details concerning visits to VCUQ including itineraries and hospitality arrangements.

Ransomware group Dispossessor claimed responsibility for the attack and posted a video showing some of the data the group says it stole.

VCUQ has not verified Dispossessor’s claim. The school’s notice (PDF) to victims states, “We received information suggesting that some personal information may have been accessed or viewed during the ransomware incident on or about 2 July 2024.”

VCUQ says financial accounts were not compromised.

We don’t yet know whether VCUQ paid a ransom or how much Dispossessor demanded. The school has not disclosed how attackers breached its systems or how many people are affected. Comparitech contacted VCUQ for comment and will update this article if it responds.

VCUQ did not say that it would offer victims identity theft protection or credit monitoring. Victims should be on the lookout for phishing and signs of fraud on their credit reports and financial account statements.

Who is Dispossessor?

Dispossessor, a.k.a. Radar or R&D, is a ransomware gang that first surfaced in March 2024. Comparitech researchers logged four ransomware attacks claimed by Dispossessor since it began. Aside from VCUQ, they’ve all been against healthcare companies: Long Island Plastic Surgical Group, Aire Dental Arts, and Delhi Hospital AKA Richland Parish Hospital.

Long Island Plastic Surgery Group allegedly paid a $500,000 ransom in March 2024. The attack appeared to be a collaboration between ALPHV/BlackCat and Dispossessor. The latter extracted the files, and the groups split the ransom.

Delhi Hospital did negotiate with Dispossessor to reduce its ransom from $350,000 to $250,000, but ultimately no ransom paid.

We have recorded another 14 unconfirmed ransomware attacks claimed by Dispossessor.

Yesterday, Dispossessor’s website was seized by law enforcement. We don’t know yet how this will affect the group’s operations in the future.

Ransomware attacks on education

Worldwide, Comparitech tracked 63 confirmed ransomware attacks on schools, universities, and other education institutions so far in 2024, affecting 240,871 records. That figure is significantly less than in 2023, which saw 182 attacks affecting 3.8 million records in total.

The average ransom following an attack on a school is $383,000.

This month, we logged confirmed ransomware attacks on Université Paris-Saclay (France) and Gadsden Independent School District (New Mexico).

We tracked another 79 unconfirmed ransomware attacks on the education sector so far this year.

About VCUarts Qatar

Virginia Commonwealth University School of the Arts Qatar is located in Ar-Rayyan, Qatar and was the first American college built in the country’s Education City in 1998. It’s a campus of the School of the Arts of Virginia Commonwealth University, a public university in Richmond, Virginia. About 300 students enroll at VCUQ each semester.