Stanford College says the non-public info of 27,000 people was stolen in a ransomware assault impacting its Division of Public Security (SUDPS) community.
The college found the assault on September 27 and disclosed one month later that it was investigating a cybersecurity incident impacting SUDPS methods.
In an replace printed on Monday, Stanford stated the attackers did not achieve entry to different methods outdoors the Division of Public Security’s community.
“The investigation decided that an unauthorized particular person(s) gained entry to the Division of Public Security’s community between Could 12, 2023, and Sept. 27, 2023,” the college stated.
In keeping with data breach notifications filed with Maine’s Lawyer Normal, the attackers stole paperwork containing personally identifiable info (PII) belonging to 27,000 people.
“The non-public info that will have been affected varies from individual to individual however may embrace date of beginning, Social Safety quantity, authorities ID, passport quantity, driver’s license quantity, and different info the Division of Public Security might have collected in its operations,” Stanford added.
“For a small variety of people, this info can also have included biometric knowledge, well being/medical info, e-mail handle with password, username with password, security questions and solutions, digital signature, and bank card info with security codes.”
Whereas Stanford has not attributed the September incident to a selected ransomware operation, the Akira ransomware gang claimed the assault in October, saying they stole 430Gb of recordsdata from the college’s methods.
The cybercrime group has since printed the stolen knowledge on their darkish net leak web site, making it obtainable for obtain through BitTorrent.
The Akira ransomware operation emerged in March 2023 and shortly gained notoriety by concentrating on victims throughout numerous trade verticals.
By June 2023, the Akira ransomware operators had developed and deployed a Linux encryptor to focus on VMware ESXi digital machines extensively utilized in enterprise environments.
In keeping with negotiation chats seen by BleepingComputer, the ransomware group is asking for ransom funds starting from $200,000 to tens of millions of {dollars}, relying on the scale of the breached group.
Stanford College disclosed one other data breach in February 2023 after Division of Economics Ph.D. program admission info was uncovered on-line between December 2022 and January 2023.
The incident adopted an April 2021 data breach after the Clop ransomware leaked paperwork stolen from Stanford Faculty of Drugs’s Accellion File Switch Equipment (FTA) platform.
