INGV Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 12 February 2025 the Italian research body Istituto Nazionale di Geofisica e Vulcanologia, known as INGV, appeared on a ransomware group’s leak site. The listing claims that internal files were taken during an attack. For staff, partners and anyone whose details sit inside those systems, the practical question is straightforward: what left the network, who now holds it, and what can be done next.

Public detail remains limited. The number of people affected is unknown, and the precise contents of the files have not been independently confirmed. What is known is that a ransomware operation is said to have exfiltrated material and that the group has publicly named INGV as a victim.

Inside the incident

According to the available record, INGV was listed by the fog ransomware group on 12 February 2025. The report states that internal files were exfiltrated in a ransomware attack. No further technical specifics—such as the initial access method, the exact date of intrusion, the volume of data removed, or any ransom demand—have been disclosed in the public summary.

The listing itself is an assertion by the group. Independent verification of the claim, of the scale of any theft, or of whether systems were encrypted has not been provided in the facts available. People affected remain unknown. The only concrete description offered is that internal files were taken.

Inside fog

Fog is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like many such groups, it maintains a leak site on which it posts victim names and, at times, samples of stolen material. Its typical pattern includes opportunistic targeting of organisations that hold operational or research data, followed by public pressure through the listing.

In this case the group claims that INGV’s internal files were exfiltrated. No additional statements attributed to fog about this specific victim—beyond the listing itself—appear in the reported facts. Prior activity by the group is documented in open sources, but those earlier incidents do not automatically confirm the details of the present claim.

Who is INGV?

INGV is Italy’s national institute for geophysics and volcanology. It monitors seismic and volcanic activity, runs observational networks, and produces research that underpins civil-protection planning and scientific understanding of natural hazards. Institutions of this kind routinely hold staff records, research datasets, instrument logs, partner correspondence and administrative files.

A breach at such an organisation is consequential because the data can include both personal information of employees and collaborators and sensitive operational material related to monitoring networks. Even when the exact files remain unconfirmed, the potential exposure of research infrastructure details or personnel data creates lasting risk for the people and systems involved.

The information in question

The reported facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records, and no confirmation of personal identifiers, credentials or research datasets have been published. Organisations of INGV’s type typically store employee and contractor details, email archives, project documentation, instrument configurations and scientific observations. Whether any of those categories were among the files taken is unconfirmed.

Until a fuller disclosure or independent analysis appears, the precise contents must be treated as unknown. The group’s claim of exfiltration stands as an unverified assertion rather than established fact.

The real-world impact

For individuals whose information may sit inside the taken files, the risks are concrete even if the scale is unclear. Personal data can be used for phishing, identity fraud or social-engineering attempts that reference the institute’s work. Staff and partners may face targeted messages that appear legitimate because they draw on real internal context. Research or operational files, if present, could reveal monitoring practices or collaboration details that adversaries might misuse.

For INGV itself the consequences include potential disruption of research continuity, the cost of investigation and remediation, and the longer-term need to reassure partners and the public that monitoring of seismic and volcanic activity remains reliable. Because the number of people affected is unknown, the full perimeter of exposure cannot yet be drawn.

If your data was in this claimed breach

If you have any connection to INGV—current or former staff, contractor, research partner or supplier—treat the listing as a prompt to act cautiously rather than as proof that your own records were taken. Practical first steps include:

• Change passwords on any accounts that may have been used in connection with the institute, and enable multi-factor authentication where available.
• Watch for unexpected emails or messages that reference INGV projects, colleagues or internal systems; treat unsolicited requests for credentials or payments as suspicious.
• Review bank and credit statements for unusual activity if you have ever shared financial details with the organisation.
• Request a free exposure scan of your email address against known breach datasets to see whether your information has already appeared in other incidents.

Public information about this event is still sparse. Continue to rely on official notices from INGV or Italian authorities for confirmation of what was taken and who is affected. Until those details emerge, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.