Columbia College of Chicago Listed by netwalker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations that combine encryption with data theft have become a persistent feature of the threat landscape, with groups increasingly listing victims on dedicated leak sites to pressure payment. In early June 2020, Columbia College of Chicago appeared on one such site operated by the netwalker group, which stated that internal files had been taken during a ransomware intrusion.

The incident is one of many reported against educational institutions that year. Public details remain limited to the listing itself; the college has not released an official statement confirming the scope or impact of any intrusion.

What happened

On June 03, 2020, Columbia College of Chicago was listed on the netwalker ransomware group’s leak site. The group claims to have exfiltrated internal files during a ransomware attack. No information has been made public about the date of the intrusion, the number of individuals affected, or the precise volume of data involved. The college has not confirmed or denied the claims in statements available to the public.

The group behind it: netwalker

Netwalker is a ransomware operation that emerged in 2019 and gained attention for its use of double-extortion tactics. The group typically encrypts systems while also copying data, then publishes samples or file listings on a Tor-based site when ransom demands are not met. It has targeted a range of organizations, including healthcare providers, local governments, and educational entities. The listing of Columbia College of Chicago constitutes the group’s public claim of access; independent verification of the data’s authenticity or completeness has not been reported.

About Columbia College of Chicago

Columbia College of Chicago is a private nonprofit institution focused on arts, media, and communication programs. Like other colleges, it maintains records on current and former students, faculty, and staff, along with financial, administrative, and operational information required for enrollment, payroll, and regulatory compliance. Educational organizations hold data that can include personal identifiers, academic histories, and contact details, making them attractive targets for actors seeking either direct leverage or resale value on underground markets.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. No inventory of specific file types, databases, or record counts has been disclosed. Organizations of this type commonly store student transcripts, financial aid records, employee personnel files, and vendor contracts, but the exact contents of any material taken in this case remain unconfirmed.

What's at stake

Exposure of internal files can create downstream risks for individuals whose records appear in those materials, such as misuse of personal identifiers for fraud or targeted phishing. For the institution, the incident may involve costs related to investigation, system restoration, and potential regulatory notifications, even when the full scope of data remains unclear. The absence of Reported Details limits precise assessment of individual impact at this time.

What to do if you're exposed

Individuals connected to the college can begin by monitoring their financial accounts and credit reports for unusual activity. Changing passwords for any college-related accounts and enabling multi-factor authentication where available are standard first measures. Those who wish to check whether their email address appears in known breach datasets can use a free exposure scan service.

• Review recent account statements and credit reports.
• Update passwords and enable multi-factor authentication.
• Run a free exposure scan of your email address.

AICompiled with AI assistance from public sources and published under our editorial standards.