ORU Mabee Center Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

ORU Mabee Center has been listed by the rhysida ransomware group, according to a report dated January 24, 2025. Public details indicate that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further specifics about the incident have not been disclosed. This matters because the Mabee Center operates as a key venue tied to Oral Roberts University, handling operational and event-related information that could affect staff, partners, and visitors if compromised.

The listing itself represents a claim by the group rather than independently Reported Details from the organization. Exact timing, scale, and method of the intrusion are not publicly detailed beyond the report of file exfiltration.

Inside the incident

According to available reporting, ORU Mabee Center appeared on a rhysida leak site listing on or around January 24, 2025. The core claim is that internal files were taken during a ransomware attack. No confirmed figures for the volume of data, the precise date of intrusion, or the technical method used have been released in the public record. The number of individuals potentially affected is listed as unknown. Organizations facing such listings often face pressure from the threat actor to negotiate, but no verified statements from ORU Mabee Center confirming or denying the claims have been included in the provided facts. Public detail on containment steps or any recovery process remains limited.

The group behind it: rhysida

Rhysida is a ransomware operation that emerged in public reporting in 2023 and has since been associated with double-extortion tactics. The group typically encrypts systems while also claiming to steal data, then posts victim names on a dedicated leak site to increase pressure for payment. Established public accounts describe rhysida as using phishing or exploited vulnerabilities for initial access, followed by lateral movement and data theft before encryption. The group has previously listed educational institutions, healthcare providers, and other organizations across multiple countries. In this case, the listing of ORU Mabee Center is presented as a claim by the group; the facts do not state that rhysida successfully encrypted systems or that any ransom demand was met. No specific statements attributed to rhysida about this victim beyond the listing itself appear in the record.

About ORU Mabee Center

ORU Mabee Center is the multi-purpose arena and events facility associated with Oral Roberts University (ORU), a private liberal arts university in Tulsa, Oklahoma. The university offers programs across business, biology, engineering, computer science, nursing, criminal justice, theology, and ministry, among others. The Mabee Center hosts athletic competitions, concerts, graduations, and community events, serving students, faculty, staff, performers, and the public. As an events venue linked to a university, it typically manages scheduling systems, ticketing records, vendor contracts, employee information, and operational documents. A breach involving such an organization can disrupt campus operations and raise concerns for anyone whose contact or administrative data intersects with the center’s activities. The university setting means the facility sits within a broader educational environment that routinely handles sensitive personal and institutional records.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, categories, or specific data elements has been disclosed. Organizations of this kind commonly hold employee records, event attendee lists, vendor agreements, financial documents, facility access logs, and correspondence related to university operations. Because the exact contents remain unconfirmed, it is not possible to state which of these, if any, were included. The report does not name personal identifiers, financial details, or health information as verified exposures. Readers should treat the scope as limited to the general description of internal files until additional official information appears.

What's at stake

For individuals whose information may have been among the internal files, risks include potential misuse of contact details, employment data, or event-related records for phishing or identity-related fraud. The absence of a confirmed count of affected people means the practical impact cannot yet be measured. For ORU Mabee Center and the wider university, the incident raises operational concerns: possible disruption to event scheduling, vendor relationships, and internal systems, along with the need to assess and notify any parties whose data may have been involved. Reputation and trust with students, staff, and the community can also be affected when a ransomware group publicly lists an institution. Because the facts provide no dollar amounts, recovery timelines, or confirmed notifications, the full consequences remain open. Calm monitoring of official university communications is the most reliable next step for those connected to the center.

Were you affected?

If you have worked at, attended events at, or otherwise shared information with ORU Mabee Center or Oral Roberts University, consider taking basic precautions. Monitor financial and email accounts for unexpected activity, enable multi-factor authentication where available, and be alert to phishing messages that reference the university or recent events. Change passwords on any accounts that may have reused credentials linked to university systems. Because the number of people affected is unknown and the precise data contents are unconfirmed, there is no public list of individuals to check against. Readers can run a free exposure scan of their email address to see whether their information has appeared in known breach data sets. Stay attentive to any formal notices issued by the university itself for the most accurate guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.