SCAD EDU Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a ransomware group lists a university on its leak site, the people most directly concerned are students, alumni, faculty, and staff whose personal and academic records may sit inside the institution’s systems. In late December 2022, SCAD EDU—Savannah College of Art and Design—appeared in such a listing attributed to the AvosLocker ransomware group. Public detail on the incident remains limited: the number of people affected is unknown, and the precise scope of what was taken has not been independently confirmed. What is known is enough to warrant careful attention from anyone connected to the school.

Ransomware claims are not the same as verified disclosures. Still, when internal files are said to have been exfiltrated, the practical stakes are real. Contact details, academic records, and administrative data are the kinds of information universities routinely hold, and their exposure can lead to phishing, identity misuse, or unwanted contact long after the initial incident fades from the news.

Breaking down the breach

According to the available record, SCAD EDU was listed by the AvosLocker ransomware group on or about December 26, 2022. The report describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. A sample description associated with the listing refers to one database, a file list, and email and phone information said to appear in a sample, with a claim that a fuller release would follow within two weeks. No confirmed figure for the number of individuals affected has been published in the material at hand, and independent verification of the volume or exact contents of any stolen data is not part of the public record summarized here.

Timing beyond the reported listing date, the initial intrusion method, and any ransom demand or negotiation outcome are undisclosed in the facts provided. The listing itself should be treated as a claim by the group rather than as a fully corroborated forensic account. What can be stated plainly is that the organization was named in connection with an alleged ransomware operation involving exfiltration of internal material.

Who is avoslocker?

AvosLocker is a ransomware operation that became widely documented in open reporting in the early 2020s. Like other groups in the double-extortion model, it has typically encrypted victim systems and separately claimed to steal data, then threatened to publish that data on a dedicated leak site if payment was not made. The group has been associated with attacks across multiple sectors, including education, and has used affiliate-style arrangements in which partners deploy the ransomware in exchange for a share of proceeds.

Public technical reporting has described AvosLocker payloads affecting Windows environments and, in some cases, other platforms, along with pressure tactics that include countdown timers and staged releases of sample files. None of that general pattern proves the specific contents or success of any single claim. In this instance, the group’s listing of SCAD EDU is an assertion that data was taken and would be leaked; it is not, on the facts given, an independently audited inventory of what was actually removed or later published.

SCAD EDU and its sector

Savannah College of Art and Design (SCAD) is a private nonprofit art and design university founded in 1978. It operates campuses in Savannah and Atlanta, Georgia, a study-abroad location in Lacoste, France, and online degree programs. The institution enrolls more than 14,000 students from the United States and abroad and offers a wide range of undergraduate and graduate programs in art, design, and related fields.

Higher-education organizations hold concentrated stores of personal and operational information: student and employee contact data, admissions and financial-aid records, academic histories, and internal administrative files. A breach in this sector is consequential because the same individuals often remain linked to the institution for years—as students, alumni, or staff—and because educational records can be reused in targeted fraud or social-engineering attempts. The presence of international students and multiple campuses can also widen the geographic reach of any exposed contact information.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The associated sample description refers to a database, a file list, and email and phone data said to appear in a sample, with a claim of a broader release. Exact data types beyond that description are not independently detailed in the record provided, and the number of affected people is unknown.

Organizations of this kind typically maintain student and employee directories, email systems, academic and administrative databases, and shared file repositories. It is reasonable to expect that such categories could be implicated in an internal-files claim, but it would be inaccurate to treat any specific field—Social Security numbers, financial accounts, health data, or otherwise—as confirmed for this incident when the public summary does not establish them. The exact contents remain unconfirmed outside the group’s own assertions and the limited sample language reported.

The real-world impact

For individuals, the primary risks are secondary misuse of contact and identity-related information: phishing or smishing that references the school, attempts to reset accounts using known email addresses, and broader identity fraud if additional personal details were included in any taken files. Even partial directories of names, emails, and phone numbers can make social-engineering messages more convincing. Because the count of affected people is unknown, it is not possible to say how widely those risks extend.

For the institution, a ransomware event with alleged exfiltration can mean operational disruption, investigative and recovery costs, regulatory and contractual notification duties, and lasting damage to trust among students, families, and partners. Publication of internal files—if it occurred as claimed—can also expose business processes or correspondence that were never intended for public view. None of these outcomes require assuming negligence; they are the ordinary consequences when sensitive systems are compromised and data is copied outward.

If your data was in this claimed breach

If you studied at, worked for, or otherwise dealt with SCAD around the time of the reported listing, treat unsolicited messages that reference the school or your relationship to it with caution. Prefer official channels you initiate yourself when checking accounts. Consider updating passwords on email and other critical services, especially where you reused credentials, and enable multi-factor authentication where it is available. Monitor financial and credit activity for unfamiliar inquiries if you have reason to believe richer identity data may have been involved, keeping in mind that such involvement is not confirmed here.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That step does not prove whether you were or were not part of this specific incident, but it can help you see whether your address appears in other circulated collections and prioritize further precautions accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.