MRC Prion Unit and Institute of Prion Diseases Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The MRC Prion Unit and Institute of Prion Diseases were listed by the crypto24 ransomware group on January 24, 2026, after internal files were exfiltrated in an attack whose timing has not been established. Anyone connected to the organisations should review any communications they have received and follow official guidance on protecting their information.
The MRC Prion Unit and Institute of Prion Diseases was listed by the crypto24 ransomware group on January 24, 2026. The listing states that internal files were exfiltrated during a ransomware attack, with the group indicating that full data will be released once a timer expires. The number of people affected has not been reported.
Inside the incident
Public information is confined to the leak-site listing itself. No details have been released about when the intrusion occurred, how access was obtained, or the volume of material taken. The organisation has not issued a statement confirming or denying the claims, and independent verification of the data's existence or contents is not available.
The group behind it: crypto24
Crypto24 is a ransomware operation that follows the double-extortion model common among current threat actors. It typically encrypts systems and removes copies of files, then uses a leak site to pressure victims by threatening publication. The group has appeared in multiple prior incidents involving research and healthcare organisations. In this case the listing constitutes the group's claim; no independent confirmation of the exfiltration or its scope has been established.
About MRC Prion Unit and Institute of Prion Diseases
The MRC Prion Unit and Institute of Prion Diseases conducts medical research into prion-related conditions. Such units routinely maintain laboratory records, research datasets, and administrative material connected to scientific studies. Because the work involves human tissue samples and clinical observations, the records can include information that is both scientifically sensitive and subject to data-protection requirements.
What data was at risk
The listing refers only to “internal files.” No inventory of specific file types or data categories has been published. Organisations engaged in prion-disease research commonly hold experimental results, study protocols, and limited personal identifiers linked to research participants. The precise contents of any exfiltrated material remain unconfirmed.
The real-world impact
Exposure of research files could affect the confidentiality of ongoing studies and the privacy of individuals whose data appear in those records. For the organisation, the incident may require forensic examination, system restoration, and notification obligations under applicable data-protection rules. No evidence of subsequent misuse of the material has been reported to date.
Were you affected?
Individuals who have participated in studies linked to the unit or who have corresponded with its staff can monitor their email accounts for unusual activity and consider placing fraud alerts with credit agencies where relevant. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in previously published lists, though it cannot confirm involvement in this specific incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Qatar Biomedical Research Institute (QBRI) Listed by crypto24 Ransomware GroupComprehensive Orthopaedics and Musculoskeletal Care, LLC Listed by crypto24 Ransomware GroupTien Tuan Pharmaceutical Machinery Co. Ltd Listed by crypto24 Ransomware GroupIndustrias Guerra, S.A. Listed by crypto24 Ransomware GroupLatest breaches
Publicly posted by crypto24 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.