Basque Center for Applied Mathematics-BCAM Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Breaking down the breach

The incident is known only through the public listing on the avaddon site. The entry states that internal files were exfiltrated, but provides no additional technical description of how access was obtained or how much material was removed. The number of people affected is not stated in any available report, and the organization has not issued a separate statement confirming or disputing the claims.

Because the listing itself constitutes the primary source of information, the scale of the operation and the exact date range of the activity remain undisclosed.

Inside avaddon

Avaddon operated as a ransomware-as-a-service group that relied on double-extortion tactics. After encrypting systems, the operators would copy selected files and threaten to publish them on a dedicated leak site unless a ransom was paid. The group maintained an active presence on such sites throughout 2020 and 2021, listing a range of victims from different sectors. Public reporting on the group’s infrastructure and payment methods comes from law-enforcement actions and independent security research conducted during that period.

In this instance the group claims to have stolen internal data from Basque Center for Applied Mathematics-BCAM, but no independent verification of the claim or of the data’s subsequent handling has been published.

Basque Center for Applied Mathematics-BCAM and its sector

The Basque Center for Applied Mathematics-BCAM is a research institution focused on applied mathematics, working with academic, industrial, and governmental partners. Organizations of this type routinely store project documentation, collaborator contact details, grant records, and internal administrative files. A breach that exposes such material can affect ongoing research relationships and the privacy of individuals whose information appears in those records.

Research centers hold datasets and communications that are not always classified yet can still contain commercially or personally sensitive content, making any confirmed exfiltration a matter of institutional concern.

What data was at risk

The only information released is that internal files were claimed to have been taken. No inventory of file types, no count of records, and no confirmation of personal data categories have been provided. Organizations in this sector commonly retain staff records, research contracts, and technical documents, but the precise contents of any material listed by the group are unconfirmed.

• Listing appeared on avaddon leak site on September 9, 2021
• Claim limited to exfiltration of internal files
• Number of individuals affected remains unknown

The real-world impact

Individuals whose details appear in the exfiltrated files could face risks of targeted phishing or misuse of contact information, though the extent of any personal data remains unknown. For the center itself, the incident introduces uncertainty around research continuity and partner trust until the scope of the exposure is clarified.

Without a published forensic summary, the practical consequences for affected people or collaborating institutions cannot be quantified beyond the general risks associated with the publication of internal organizational material.

Were you affected?

Anyone who has corresponded with or worked alongside Basque Center for Applied Mathematics-BCAM can take routine protective steps while awaiting further official information. These include reviewing account activity for unusual logins, enabling multi-factor authentication on any services that may hold related contact details, and monitoring official statements from the organization.

Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.