eap.gr Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People connected to the Hellenic Open University may now face uncertainty about whether their personal or academic records were among materials claimed to have been taken. On 25 October 2024 the ransomware group ransomhub listed eap.gr on its leak site, asserting that internal files had been exfiltrated. The number of individuals affected remains unknown, and public detail on the precise contents is limited, yet any such claim raises practical questions for students, staff and alumni whose data a distance-learning university routinely holds.

Because the listing is an unverified claim by the group itself, the full scope of the incident is still unconfirmed. What is clear is that a public Greek institution focused on open and lifelong education has been named in a ransomware operation that typically combines encryption with data theft. For those whose details may be involved, the immediate concern is not speculation but understanding what is known, what is not, and what steps can reduce risk.

What happened

According to the available record, eap.gr was listed by the ransomhub ransomware group on 25 October 2024. The group claims that internal files were exfiltrated during a ransomware attack. No public confirmation of the intrusion method, the exact date of the compromise, the volume of data taken, or any ransom demand has been disclosed. The number of people affected is listed as unknown. Beyond the assertion that internal files were removed, further technical or operational details of the incident itself remain undisclosed.

Ransomhub’s leak-site entry constitutes a claim rather than independent verification. Organisations named in this way sometimes later confirm or deny the event; at the time of reporting, no such confirmation appears in the provided facts. The incident is therefore best understood as a public allegation of data theft tied to a ransomware operation, with the concrete scale and contents still unconfirmed.

Inside ransomhub

Ransomhub is a ransomware operation that became publicly active in 2024, widely reported as having filled part of the vacuum left by the disruption of earlier groups such as ALPHV/BlackCat. Like many contemporary ransomware crews, it operates on a double-extortion model: systems are encrypted and data is also stolen, after which the group pressures the victim by threatening to publish the material on a dedicated leak site if payment is not made. Affiliates often carry out the initial access and deployment, while the core group manages the leak infrastructure and negotiations.

Public reporting has associated ransomhub with a range of victims across sectors and countries, typically listing organisations once the group asserts that exfiltration has occurred. The group’s leak site serves as both a pressure tool and a public noticeboard; listings are claims made by the operators and should be treated as such until independently verified. No statements attributed specifically to ransomhub about eap.gr beyond the listing itself are contained in the facts provided here.

About eap.gr

eap.gr is the online presence of the Hellenic Open University (Helleniko Anoikto Panepistimio), a public Greek university specialising in distance and open learning. It offers undergraduate and postgraduate programmes designed primarily for adult learners who need flexible study arrangements. As a public higher-education institution it maintains records necessary for admissions, enrolment, assessment, staff administration and lifelong-learning services.

Universities of this type typically process identity documents, contact details, academic transcripts, financial and fee information, and sometimes health or accessibility data required for student support. A breach claim against such an organisation is consequential because the data it holds can be long-lived and personally sensitive, and because students and staff may have limited ability to change core identifiers such as national ID numbers or academic histories. The public character of the institution also means any confirmed compromise can affect trust in open-education services more broadly.

What data was at risk

The facts state only that “internal files” were claimed to have been exfiltrated in a ransomware attack. No further breakdown of file types, databases or record categories has been disclosed. Exact contents therefore remain unconfirmed.

Organisations of this kind ordinarily hold student and staff personal data, academic records, administrative correspondence and operational documents. Whether any of those categories were among the material ransomhub claims to possess cannot be established from the public record. Readers should treat specific data types as unconfirmed until the university or independent investigators provide clearer information.

What's at stake

For individuals, the practical risks centre on the possible misuse of personal or academic information if the claimed files prove authentic and are later published or sold. Identity-related details can facilitate phishing, social-engineering attempts or fraudulent applications; academic records can be used to impersonate students or staff. Because the number of people affected is unknown, it is not possible to say how widely any exposure extends.

For the university, the stakes include operational disruption if systems were encrypted, reputational damage, potential regulatory scrutiny under European data-protection rules, and the cost of investigation and remediation. Until more detail emerges, both the human and institutional consequences remain partly speculative, grounded only in the group’s claim that internal files left the network.

What to do if you're exposed

If you have studied or worked at the Hellenic Open University, treat the listing as a reason for caution rather than confirmed personal compromise. Practical first steps include:

• Monitor bank, email and academic accounts for unexpected activity or password-reset requests.
• Enable multi-factor authentication wherever it is offered, especially on email and student portals.
• Be sceptical of unsolicited messages that reference university records or demand urgent action.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach datasets.
• Keep records of any suspicious contact and report confirmed fraud to the relevant authorities.

Public detail on this incident remains limited. Further statements from the university or independent verification would clarify the true extent of any exposure. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.