Federal University of Mato Grosso do Sul Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 24, 2023, the Federal University of Mato Grosso do Sul was listed by the rhysida ransomware group, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and public detail on the incident is limited to that listing and the description of internal files as the material involved.

For a public university serving students, staff, and researchers in Brazil, any confirmed exposure of internal material raises practical questions about administrative records, academic data, and personal information that such institutions routinely handle. At this stage the claim originates from the group’s leak site and has not been independently detailed in the available record.

Inside the incident

According to the reported information, the Federal University of Mato Grosso do Sul appeared on a rhysida listing dated September 24, 2023. The group described the event as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data, the precise date the intrusion began or ended, the initial access method, or the number of individuals whose information may have been involved. Those elements remain undisclosed.

Ransomware incidents of this type typically combine encryption of systems with theft of data for leverage. In this case the only concrete assertion on record is the group’s claim that internal files were taken. Whether systems were encrypted, whether a ransom demand was issued, and whether any negotiation or recovery occurred have not been stated in the available facts. The listing itself constitutes the primary public marker of the incident.

Who is rhysida?

Rhysida is a ransomware operation that became publicly visible in 2023. Like many contemporary groups, it has followed a double-extortion model: encrypting victim systems while also copying data and threatening to publish it if payment is not made. The group has operated a leak site on which it names organizations and, in some cases, releases samples or larger sets of stolen files. It has been observed targeting a range of sectors, including education, healthcare, government, and private enterprise, across multiple countries.

Rhysida has been characterized in public reporting as a ransomware-as-a-service style operation, in which affiliates may conduct intrusions and share proceeds with the core developers. Its typical tactics have included exploitation of exposed services, use of legitimate remote-access tools, and pressure campaigns built around timed data leaks. None of these general patterns should be read as confirmed specifics of the Federal University of Mato Grosso do Sul case; they describe the group’s established public profile. With respect to this university, the sole documented assertion is the leak-site listing claiming exfiltration of internal files.

Who is Federal University of Mato Grosso do Sul?

The Federal University of Mato Grosso do Sul is a public university located in the state of Mato Grosso do Sul in Brazil. As a federal institution of higher education it provides undergraduate, graduate, and research programs and maintains the administrative, academic, and support systems common to large public universities. Such organizations typically hold student enrollment and academic records, employee and payroll data, research materials, financial and procurement files, and internal communications.

A breach affecting a public university is consequential because the institution serves a broad community of students, faculty, staff, and external partners, many of whom have little choice but to entrust personal and academic information to it. Disruption of systems can affect teaching, research continuity, and essential administrative services. Even when the precise scope of stolen data is unconfirmed, the mere listing by a ransomware group creates uncertainty for anyone whose information may reside in university systems.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, record counts, or data fields has been disclosed. It is therefore not possible to state as fact which specific types of personal or institutional information were taken.

Organizations of this kind ordinarily maintain a wide range of internal material, including student and staff personal identifiers, academic transcripts, human-resources files, financial records, email and document repositories, and research-related data. Whether any or all of those categories were present in the exfiltrated set remains unconfirmed. Readers should treat the contents as unknown until verified by the institution or another authoritative source.

What's at stake

When internal university files are claimed to have been stolen, the practical risks for individuals include potential misuse of personal details for phishing, identity fraud, or targeted social engineering. Staff and students may face follow-on scams that reference real university processes or names. For the institution, stakes include operational disruption, the cost of investigation and remediation, possible regulatory notification duties under Brazilian data-protection rules, and erosion of trust among the academic community.

Because the number of people affected is unknown and the exact data types are not itemized beyond “internal files,” the scale of individual harm cannot be quantified from the public record. The absence of confirmed detail does not eliminate risk; it simply means affected parties must proceed on the assumption that some internal material may be in unauthorized hands until clearer information emerges.

What to do if you're exposed

If you are a student, employee, alumnus, or partner of the Federal University of Mato Grosso do Sul and believe your information may have been involved, practical first steps are straightforward and do not require waiting for further official confirmation.

• Monitor financial and academic accounts for unexpected activity and enable multi-factor authentication wherever it is offered.
• Treat unsolicited emails, messages, or calls that reference the university or this incident with caution; verify through official channels before responding or clicking links.
• Consider placing fraud alerts with relevant credit or identity-protection services if you have reason to believe sensitive personal data was held by the university.
• Keep records of any suspicious contact and report confirmed fraud to the appropriate local authorities.
• Run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets.

Public detail on this incident remains limited to the September 24, 2023 listing and the claim of internal-file exfiltration. Further clarity, if it becomes available, would come from the university or independent verification rather than from the threat actor’s statements alone.

AICompiled with AI assistance from public sources and published under our editorial standards.