Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 February 2025 the ransomware group known as fog listed Gitlabs associated with Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt and iRidge Inc. on its leak site. The group claims to have stolen internal data in a ransomware attack. Public reporting so far provides no confirmed figure for the number of people affected and offers few further operational details.

The listing itself is the primary public signal that an incident occurred. Because the claim originates from the threat actors, independent verification of the full scope remains limited at this stage.

Inside the incident

According to the available record, the organisations were named on the fog ransomware leak site on 9 February 2025. The group states that internal files were exfiltrated during a ransomware attack. No public information has been released about the precise date of initial access, the technical method used, the volume of data taken, or whether encryption of systems also took place. The number of individuals whose information may have been involved is listed as unknown. Beyond the leak-site claim that internal data was stolen, further specifics have not been disclosed.

The group behind it: fog

Fog is a ransomware operation that became active in public reporting during 2024. Like many contemporary ransomware groups it typically follows a double-extortion model: data is copied from victim networks before systems are encrypted, and the stolen material is then used as leverage on a dedicated leak site if payment is not made. The group has previously listed organisations across multiple sectors and geographies, publishing sample files or full archives when it asserts that negotiations have failed. Its leak-site postings are claims made by the actors themselves and are not independently verified at the moment of publication. In this case the listing of the Gitlabs associated with Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt and iRidge Inc. follows that established pattern; no additional statements from fog about these particular victims have been reported beyond the assertion that internal data was taken.

About Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc.

The named entities comprise a major technical university in Romania, a private technology company and a Japanese firm, each apparently operating or associated with GitLab instances that were listed together. Universitatea Politehnica din Bucuresti is a large public higher-education institution focused on engineering and applied sciences; such universities routinely manage student records, research materials, staff information and administrative systems. Maxvy Technologies Pvt operates in the technology sector and would be expected to hold proprietary code, project documentation and client-related material. iRidge Inc. is a commercial enterprise whose systems would typically contain business correspondence, operational files and customer data. GitLab platforms are widely used for source-code management, issue tracking and collaborative development; a compromise of such systems can therefore expose both technical assets and the personal or organisational information stored alongside them. A breach involving these environments is consequential because the data held by universities and technology firms often includes identifiers, intellectual property and internal communications that retain value long after an incident.

What data was at risk

The only data type named in public reporting is “internal files” said to have been exfiltrated. No further breakdown—such as whether the files contained personal identifiers, source code, financial records, research data or credentials—has been disclosed. Organisations of this kind commonly store student or employee details, project repositories, authentication tokens, contracts and internal correspondence on their development platforms. Because the precise contents remain unconfirmed, it is not possible to state which specific categories of information were actually taken. The claim is limited to the existence of stolen internal files.

The real-world impact

If the exfiltrated material includes personal or authentication data, affected individuals could face risks of phishing, credential stuffing or identity misuse. For the organisations themselves, exposure of internal files may lead to competitive harm, disruption of research or development work, regulatory scrutiny and the need to notify partners or regulators. Because the scale and exact composition of the data are unknown, the concrete number of people or systems affected cannot yet be quantified. Even limited internal documents can, however, provide attackers with enough context to craft more convincing follow-on social-engineering attempts or to identify further targets within the same networks.

If your data was in this claimed breach

Anyone who has used services or accounts linked to these organisations should treat the possibility of exposure seriously. Change passwords on related accounts, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. Be alert to unexpected messages that reference the organisations or that request urgent action. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check provides an additional, independent signal of whether personal information has circulated. If further official notifications are issued by the organisations, follow the specific guidance they provide.

AICompiled with AI assistance from public sources and published under our editorial standards.