bsm.upf.ed Listed by lockbit2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 20, 2022, the domain bsm.upf.ed appeared on a leak site operated by the ransomware group lockbit2. The listing indicated that internal files had been taken from the organisation during a ransomware incident, though the number of individuals affected and the precise contents of the data remain unknown. The group stated that it had exfiltrated material and placed the organisation on its public disclosure page. No further details on the timing of the intrusion, the volume of data, or the method of access have been made public.

What happened

bsm.upf.ed was added to the lockbit2 ransomware leak site on May 20, 2022. The entry described the removal of internal files during a ransomware attack. The number of people potentially affected is not stated, and no confirmation of the data’s release or subsequent actions by the organisation has been provided in public records.

Who is lockbit2?

Lockbit2 is the name used by a ransomware-as-a-service operation that has been active since at least 2019. The group supplies encryption tools to affiliate attackers in exchange for a share of ransom payments. Its standard approach involves encrypting systems and, in many cases, copying data beforehand to create leverage through threatened publication on a dedicated leak site. The group has appeared in multiple law-enforcement alerts and has targeted organisations across sectors and countries.

About bsm.upf.ed

bsm.upf.ed is an educational institution operating under the Universitat Pompeu Fabra in Barcelona. Entities of this type maintain records on students, faculty and administrative staff, along with research materials, financial information and operational documents. A compromise at such an organisation can affect both the immediate community and any external partners whose data is held in shared systems.

What was likely exposed

The only detail released is that internal files were taken. The exact categories of information contained in those files have not been disclosed. Organisations in the higher-education sector commonly store personal identifiers, academic records, contact details and limited financial data; however, whether any of these specific types were present in the exfiltrated material is unconfirmed.

Why it matters

Even without a confirmed count of affected individuals, the exposure of internal files from an educational institution can create lasting administrative and privacy consequences for students and staff. Such records often contain information that remains relevant for years, increasing the window during which misuse could occur. For the organisation, the incident adds operational disruption and the need to review access controls and data-handling practices.

If your data was in this claimed breach

Monitor official communications from bsm.upf.ed for any guidance it may issue. Enable multi-factor authentication on accounts that use the same email address or password, and review statements from banks or government services for unusual activity. Individuals can also run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.