sorbonne-universite.fr Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list universities and research institutions on leak sites as part of a broader pattern of double-extortion attacks against education and public-sector targets. In this climate, the appearance of a major French university domain on such a site draws attention because of the sensitive research, administrative and personal data these organisations typically manage.

On 5 June 2025, the domain sorbonne-universite.fr was listed by the funksec ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical details have not been disclosed. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Inside the incident

According to the reported information, sorbonne-universite.fr was named on a funksec leak site on 5 June 2025. The summary characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No public figures have been released for the volume of data taken, the number of systems involved, or the precise timeline of intrusion and discovery. Method of initial access, encryption status of systems, and any ransom demand are undisclosed. The only concrete assertion available is the group’s claim that internal files were removed during the incident. Whether the university has verified the claim, contained the intrusion, or notified regulators is not stated in the public facts.

Inside funksec

Funksec is a ransomware operation that has appeared in public reporting as a double-extortion actor: it encrypts systems and simultaneously claims to have stolen data, then pressures victims by threatening publication. Like other groups in this category, it maintains a leak site on which it posts victim names and, in some cases, sample files. Its typical tactics include opportunistic scanning for exposed services, use of commodity or custom ransomware payloads, and data-exfiltration tools before encryption. Prior public listings have involved organisations across multiple sectors, though the group’s precise membership, infrastructure and revenue model remain only partially documented. In the present case the sole specific claim is the listing of sorbonne-universite.fr and the assertion that internal files were exfiltrated; no further statements attributed to funksec about this victim appear in the given record.

sorbonne-universite.fr and its sector

Sorbonne Université is a major French public research university based in Paris, formed in 2018 by the merger of Pierre et Marie Curie University and Paris-Sorbonne University. It offers programmes across sciences, medicine, humanities and the arts and maintains a substantial research portfolio. Institutions of this type hold large volumes of student and staff personal data, research datasets, grant and financial records, medical and clinical information linked to teaching hospitals, and intellectual property. A breach at such an organisation is consequential because the data often include long-lived identifiers, academic and health records, and unpublished research that can affect individuals for years and can damage institutional reputation and research partnerships. Higher-education bodies also face regulatory obligations under European data-protection rules, making any confirmed compromise a matter of both operational and legal significance.

What data was at risk

The available facts state only that “internal files” were exfiltrated. No inventory of file types, databases or record counts has been published. Organisations of this kind commonly store student enrolment and academic records, staff personnel files, research data (including potentially sensitive scientific or medical material), administrative correspondence, financial and procurement documents, and authentication credentials. Because the precise contents remain unconfirmed, it is not possible to state which of these categories, if any, were involved. Readers should treat any claim of specific data exposure as unverified until the university or competent authorities provide further detail.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include identity fraud, targeted phishing that leverages academic or employment details, and, in the case of health-related or research data, potential privacy harms. For the university the stakes include disruption of teaching and research systems, possible regulatory scrutiny, costs of investigation and remediation, and erosion of trust among students, staff and research partners. Because the scale of the exfiltration is unknown, the actual number of people exposed cannot be quantified from public sources. The incident also illustrates the continuing attractiveness of research-intensive universities to ransomware operators seeking both payment and leverage through data publication.

What to do if you're exposed

If you have a connection to Sorbonne Université—as a student, staff member, alumnus or research collaborator—consider the following practical steps while official confirmation remains limited:

• Monitor bank, credit and academic accounts for unexpected activity and enable multi-factor authentication wherever available.
• Treat unsolicited emails or messages that reference university systems or personal details with caution; verify any request through official channels.
• Change passwords for university-related and personal accounts that may have been reused, and review connected applications for unusual access.
• Retain any official notices from the university or French data-protection authorities and follow their guidance on free credit monitoring or identity-protection services if offered.
• Run a free exposure scan of your email address against known breach datasets to check whether your information has already appeared in public dumps unrelated or related to this incident.

Public detail on this listing remains sparse. Continued monitoring of statements from the university and from competent authorities is the most reliable way to learn whether personal data were confirmed to be among the internal files claimed by funksec.

AICompiled with AI assistance from public sources and published under our editorial standards.