richmont.edu Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For students, alumni, faculty and staff connected to Richmont Graduate University, the appearance of the institution on a ransomware group's leak site raises immediate questions about whether personal or academic records may have been taken. When internal files are claimed to have been stolen, the practical stakes include potential exposure of contact details, academic histories or other sensitive information that could be misused for fraud or unwanted contact. Public detail remains limited, and the number of people affected is unknown, so individuals cannot yet know with certainty whether their own data is involved.

What is known is that the group known as lockbit3 listed richmont.edu in late December 2023, asserting that it had exfiltrated internal files in a ransomware attack. That listing is a claim by the group rather than an independently confirmed disclosure of the full scope or contents. Understanding the incident, the actor behind the claim, and the typical risks for an organisation of this type can help those who may be affected decide what practical steps to take.

What happened

On December 26, 2023, richmont.edu was reported as listed by the lockbit3 ransomware group. The group's own post identified the organisation as "Richmont Graduate University," describing it as a nonprofit providing graduate education in professional counseling and mental health fields. According to the listing, internal files were exfiltrated in a ransomware attack. No further public detail has been provided on the precise timing of any intrusion, the method used, the volume of data taken, or whether systems were encrypted. The number of people affected remains unknown, and no official confirmation of the full extent of any breach has been included in the available record. The leak-site listing itself constitutes the group's claim that data was stolen and would be published if its demands were not met.

Inside lockbit3

Lockbit3 is a well-documented ransomware operation that has operated for years as a ransomware-as-a-service model. Affiliates gain access to networks, steal data, and deploy encryption tools; the group then pressures victims by threatening to publish the stolen material on a dedicated leak site if payment is not made. This double-extortion approach—combining encryption with data theft—has been a consistent hallmark of the brand. The group has previously claimed responsibility for attacks across many sectors, including education, healthcare and professional services, and has maintained a public-facing site where it posts victim names and sample files. Its listings are claims made by the operators; they do not automatically constitute verified proof of every detail asserted. In this case, the facts record only that lockbit3 listed richmont.edu and stated that internal files had been exfiltrated. No additional specific claims by the group about the contents or volume of data from this particular victim appear in the provided record.

richmont.edu and its sector

Richmont Graduate University is a nonprofit higher-education institution focused on graduate programs in professional counseling and mental health. Organisations of this kind typically maintain student academic records, application materials, financial-aid information, employee personnel files, and operational documents. Because the fields of counseling and mental health involve sensitive personal and sometimes clinical information, the data such an institution holds can be particularly consequential if exposed. A ransomware claim against a graduate university therefore carries weight beyond ordinary administrative inconvenience: it touches the privacy expectations of students training for licensed professions, faculty, staff and alumni. Public detail about the precise systems or departments affected in this incident is not available, but the sector context explains why the listing has drawn attention.

What was likely exposed

The available facts state only that internal files were exfiltrated in a ransomware attack. No specific data types—such as names, Social Security numbers, academic transcripts, health-related records or financial details—have been named as confirmed contents of the stolen material. Exact contents therefore remain unconfirmed. Institutions like Richmont Graduate University ordinarily hold student enrollment and academic records, contact information, employee data, and internal administrative documents. In the absence of a detailed inventory from either the organisation or independent verification, it is not possible to state what was actually taken. Readers should treat any assumption about particular categories of data as speculative until further official information is released.

The real-world impact

For individuals whose information may have been among the internal files, the concrete risks include possible identity theft, phishing attempts that reference genuine personal details, or unwanted contact. Even limited internal documents can contain enough context for social-engineering attacks. For the university itself, a ransomware claim can disrupt operations, require forensic investigation and notification efforts, and affect trust among current and prospective students. Because the number of people affected is unknown and the precise data types remain undisclosed, the scale of individual harm cannot yet be quantified. The impact is therefore best understood as a set of plausible risks rather than a catalogue of confirmed outcomes. Organisations in higher education also face regulatory and accreditation considerations when personal data may have left their control, though no public statements on those matters appear in the current record.

Were you affected?

If you are a current or former student, employee or other affiliate of Richmont Graduate University, treat the listing as a reason for heightened caution rather than confirmed personal exposure. Monitor financial accounts and credit reports for unusual activity, be alert to phishing messages that appear to reference the university or your academic history, and consider placing a fraud alert with major credit bureaus if you believe sensitive identifiers could be involved. Change passwords on any accounts that reused credentials associated with university systems. Because the full contents of the claimed exfiltration are unconfirmed, these steps remain precautionary. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets elsewhere; such a scan does not confirm or rule out involvement in this specific incident, but it provides an additional practical check against publicly circulating breach material.

AICompiled with AI assistance from public sources and published under our editorial standards.