RansomHouse claims ransomware attack on Université Paris-Saclay – 1TB allegedly stolen

This morning, ransomware gang RansomHouse claimed the recent August 2024 attack on the Université Paris-Saclay. It alleges to have stolen 1TB of data.

The French university confirmed it was hit by a ransomware attack on August 11 and that the national security agency (ANSSI) had been notified. It said it would not pay a ransom. And, in its latest update on October 4, it had set up alternative emails for all staff and students.

At the time of writing, no confirmation of a data breach has been issued by the university so we do not yet know what data is potentially involved in the attack or how many students/employees may be impacted. Comparitech has contacted the university for more information and will update this article if it responds. In the meantime, staff and students should be on high alert for any potential phishing messages and unusual activity on accounts.

Who is RansomHouse?

Since 2021, we’ve tracked 31 confirmed attacks via RansomHouse. It was recently confirmed to be the gang behind the attack on South African mining company, Sibanye-Stillwater, and Belgian healthcare company, Valisana. Webber International University and Cressex Community School are two other confirmed victims within the education sector this year (hit in February and March respectively). 

Having originated in 2021, RansomHouse employs a Ransomware-as-a-Service model. It uses a double-extortion technique whereby it both encrypts systems and steals data–as we have seen in this case against the Université Paris-Saclay.

This year, we have also tracked 34 unconfirmed attacks via this group.

Ransomware attacks against the education sector

So far this year, we’ve tracked 77 ransomware attacks against worldwide schools, colleges, and universities. These attacks have affected 253,113 records. These figures are significantly lower than those noted throughout 2023 with 184 attacks affecting nearly 3.8 million records.

Other recent attacks have included Charles Darwin School (US), the Università di Genova (Italy), Providence Public Schools (US), Heinrich-Böll-Gesamtschule & Rurtal-Gymnasium (Germany), Fylde Coast Academy Trust (UK), Richmond Community Schools (US), and Highline Public Schools (US).

We have also tracked 93 unconfirmed attacks on this sector so far this year.

About the Université Paris-Saclay

Located in the south of Paris, the Université Paris-Saclay is home to 50,000 students and 8,100 researchers and academic staff. It is a combined public research university and technological research institute.