FHNW Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to treat leak-site listings as a core pressure tactic in 2025, routinely claiming data theft from universities and research institutions even when independent confirmation is sparse. Education-sector targets remain attractive because they hold large volumes of personal and operational records and often operate complex, multi-campus IT environments. Against that backdrop, the appearance of FHNW on a ransomware leak site fits a familiar pattern of claimed double-extortion attacks whose full scope is rarely disclosed at the outset.

On 5 March 2025 FHNW was listed by the fog ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical detail is limited. The listing itself is a claim by the group and has not been independently verified in the available record.

Breaking down the breach

According to the reported summary, the incident involves the claimed exfiltration of internal files during a ransomware attack against FHNW. The only concrete date attached to the public record is the listing date of 5 March 2025. No confirmed figure for the number of individuals affected has been released, and the precise method of initial access, the duration of the intrusion, and any ransom demand are undisclosed. The reported summary characterises the material as an “extract from The 19 biggest gitlabs,” but offers no further elaboration on volume, file types, or systems involved. In short, the public facts establish only that fog listed the organisation and asserted that internal files had been taken; everything else remains unconfirmed.

The group behind it: fog

Fog is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while simultaneously claiming to steal data and threatening to publish it on a dedicated leak site if payment is not made. Like many contemporary groups, fog typically advertises victims on dark-web portals, posts sample files to demonstrate access, and sets deadlines for negotiation. Public reporting on the group’s earlier activity shows a pattern of opportunistic targeting across multiple sectors rather than a narrow focus on any single industry. In the present case the group claims to have listed FHNW and to have exfiltrated internal files; those assertions should be treated as unverified claims unless and until independent evidence appears.

About FHNW

FHNW—Fachhochschule Nordwestschweiz—is a Swiss university of applied sciences and arts serving the north-western region of the country. Institutions of this type educate thousands of students, employ academic and administrative staff, and manage research projects, campus services and external partnerships. They routinely hold student enrolment records, staff personnel files, research data, financial and contractual documents, and internal administrative correspondence. A breach affecting such an organisation is consequential because the data sets are both personal and operational: they can affect current students, alumni, employees and research collaborators, and they can disrupt teaching, research continuity and institutional reputation.

What was likely exposed

The only data category named in the public record is “internal files exfiltrated in a ransomware attack.” Exact contents, file counts and whether personal identifiers were included remain undisclosed. Organisations of FHNW’s type typically maintain student academic and contact records, employee HR and payroll information, research project materials, IT configuration data and administrative correspondence. Because none of these categories has been confirmed as present in the claimed exfiltration, any assessment of exposure must remain provisional. Readers should treat the group’s assertion of “internal files” as a claim rather than verified inventory.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, academic or employment records, and any credentials or identifiers that could facilitate phishing or identity fraud. For the institution the consequences can include operational disruption, regulatory notification obligations under Swiss data-protection rules, reputational harm and the cost of forensic investigation and remediation. Because the scale of the claimed theft is unknown, the precise level of residual risk cannot yet be quantified; the prudent stance is to assume that any internal material the group asserts it holds could surface and to prepare accordingly.

If your data was in this claimed breach

If you are a current or former student, staff member or partner of FHNW, treat the listing as a prompt for basic hygiene rather than confirmed personal exposure. Concrete first steps include:

• Monitor official FHNW communications for any confirmed notices or guidance.
• Change passwords on accounts that reuse credentials linked to university email or systems, and enable multi-factor authentication wherever available.
• Watch for unexpected phishing or social-engineering attempts that reference university affiliations or internal projects.
• Review financial and academic accounts for unusual activity and place fraud alerts if you hold sensitive Swiss or international identifiers.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in other incidents.

Public detail on this particular incident remains limited; further clarity will depend on any subsequent statements from FHNW or independent verification of the fog group’s claims.

AICompiled with AI assistance from public sources and published under our editorial standards.