Royal College of Physicians and Surgeonsof Glasgow Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For students, members, employees and others connected to the Royal College of Physicians and Surgeons of Glasgow, a listing by a ransomware group raises immediate practical questions: whether personal or professional information has left the organisation’s systems, and what that could mean for privacy, identity security and day-to-day trust in the institution. Public detail remains limited, yet the claim itself is enough to warrant careful attention from anyone whose data the college may hold.

On 20 October 2023 the college was named on a leak site associated with the akira ransomware group. The group asserted that internal files had been taken in a ransomware attack and that a large volume of data would be made available for download. The number of people affected has not been confirmed, and independent verification of the full scope is not publicly established.

What happened

According to the reported listing, the Royal College of Physicians and Surgeons of Glasgow was identified by the akira ransomware group as a victim of a ransomware attack in which internal files were exfiltrated. The listing was reported on 20 October 2023. The group’s own statement claimed that roughly 800 GB of files would shortly be offered for download and included disparaging remarks about the college’s handling of personal data belonging to students and employees. No further technical detail—such as the initial access method, the precise date of intrusion, or confirmation that data was actually published—has been supplied in the available record. The number of individuals affected remains unknown. The leak-site entry constitutes a claim by the group rather than an independently verified account of the incident.

The group behind it: akira

Akira is a ransomware operation that became active in 2023 and has been documented targeting organisations across multiple sectors, frequently using double-extortion tactics. In this model the group encrypts systems and simultaneously steals data, then threatens to publish the stolen material if a ransom is not paid. Akira has typically gained initial access through compromised credentials, exposed remote-access services or known vulnerabilities, after which operators move laterally, exfiltrate files and deploy ransomware. The group maintains a dark-web leak site on which it names victims and, in many cases, posts samples or full archives of claimed data. Its listings are public assertions; they do not by themselves prove that every claimed file set was taken or later released. In the present case the only specific assertions tied to the college are those appearing on the leak site: that internal files were exfiltrated and that approximately 800 GB would be made available.

Who is Royal College of Physicians and Surgeons of Glasgow?

The Royal College of Physicians and Surgeons of Glasgow is a professional and educational body based in Glasgow, Scotland. It supports physicians, surgeons and related healthcare professionals through examinations, training, membership services, continuing professional development and the maintenance of professional standards. Organisations of this type routinely hold records on members, trainees, examination candidates, staff and sometimes patients or research participants. Those records can include names, contact details, professional qualifications, payment information and other administrative data. A breach affecting such an institution is consequential because the data often combine personal identifiers with career-sensitive information, and because the college’s role in medical education and regulation means that trust and confidentiality are central to its work.

What data was at risk

The available facts state only that internal files were exfiltrated in a ransomware attack. The group’s listing further claimed a volume of approximately 800 GB and referred to personal data of students and employees, yet it did not publish a verified inventory of file types or data fields. Exact contents therefore remain unconfirmed. In the ordinary course of operations a medical royal college would be expected to hold membership and trainee databases, examination records, staff personnel files, financial and billing information, correspondence and internal administrative documents. Whether any or all of those categories were among the files the group claims to possess has not been independently established. No confirmed count of affected individuals has been released.

What's at stake

If personal or professional data were taken, affected individuals could face risks of phishing, identity fraud or unwanted contact that leverages accurate details about their training, membership or employment. Career-related information, once outside the organisation’s control, can be difficult to retract and may be misused over a long period. For the college itself the incident raises operational, reputational and regulatory considerations: the need to investigate, to notify relevant authorities and individuals where required, and to restore confidence among members and staff. Because the scale and precise contents are undisclosed, the concrete impact on any single person cannot yet be measured; the prudent assumption is that anyone whose information the college held should treat the claim seriously until clearer information emerges.

If your data was in this claimed breach

If you have a past or present connection to the Royal College of Physicians and Surgeons of Glasgow—as a member, trainee, examination candidate, employee or contractor—consider practical steps. Monitor financial and email accounts for unusual activity, treat unsolicited messages that reference the college with caution, and enable multi-factor authentication wherever it is available. If you receive formal notification from the college, follow the guidance it provides. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Keep records of any suspicious contacts and report them to the appropriate authorities if fraud is suspected. Public detail on this incident remains limited; staying alert to official updates from the college is the most reliable way to learn whether your data was involved.

AICompiled with AI assistance from public sources and published under our editorial standards.