The University of Notre Dame Australia (nd.edu.au) Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target universities and other education providers, treating them as high-value sources of internal records and personal data that can be used for extortion. Against that backdrop, The University of Notre Dame Australia (nd.edu.au) was listed by the fog ransomware group on 11 February 2025. Public reporting states that the group claims to have exfiltrated 62 GB of internal files in a ransomware attack. The number of people affected remains unknown, and many operational details have not been disclosed.

For students, staff, alumni and partners, the listing raises immediate questions about what may have been taken and what practical steps follow. This account stays strictly within the published facts and established public knowledge of the actor and sector; where information is missing, that absence is stated plainly.

Breaking down the breach

According to the available record, The University of Notre Dame Australia was listed by the fog ransomware group on 11 February 2025. The group’s claim, as reported, is that internal files were exfiltrated during a ransomware attack and that the volume of data involved is 62 GB. No confirmed figure for the number of individuals affected has been released; that total is recorded as unknown. The precise method of initial access, the timeline of the intrusion, and whether systems were encrypted or simply used for data theft have not been publicly detailed beyond the ransomware characterisation. The listing itself constitutes the group’s assertion; independent confirmation of the full scope has not been supplied in the facts available here.

Who is fog?

Fog is a ransomware operation that has appeared in public reporting as a group that conducts double-extortion campaigns: encrypting or threatening to encrypt systems while also claiming to steal data and listing victims on a dedicated leak site if payment demands are not met. Like other contemporary ransomware actors, fog typically publicises victim names, sometimes with sample files or volume claims, in an effort to pressure organisations. Its activity has been tracked across multiple sectors, including education and professional services. In this instance the group claims The University of Notre Dame Australia as a victim and asserts the 62 GB figure; those statements remain claims pending further verification. No additional statements attributed specifically to fog about this university appear in the provided facts.

Who is The University of Notre Dame Australia (nd.edu.au)?

The University of Notre Dame Australia is a private Catholic university operating campuses in Australia and offering undergraduate and postgraduate programmes across health, education, arts, business and related fields. Like other higher-education institutions it maintains extensive digital records covering current and former students, academic and professional staff, research collaborators, applicants and administrative partners. Such organisations routinely hold identity documents, contact details, academic transcripts, financial and payroll information, research data and internal correspondence. A ransomware listing against a university is consequential because the data held can affect large numbers of individuals over long periods and because disruption to teaching, research and administrative systems can have lasting operational effects. The facts do not establish negligence or specific security failures; they simply record the public listing.

The information in question

The only data types named in the available facts are “internal files” said to have been exfiltrated in a ransomware attack, with a reported volume of 62 GB. Exact file contents, categories of personal information, or whether student, staff or research records were included have not been disclosed. Universities of this type typically store enrolment records, staff personnel files, email archives, financial transactions and research materials; any of those could fall under a broad “internal files” description. Because the precise composition remains unconfirmed, it is not possible to state which individuals or which data elements were involved. The 62 GB figure is the sole quantitative claim attached to the listing.

The real-world impact

When internal university files are claimed to have been taken, the practical risks for affected people include potential misuse of personal identifiers for phishing, account takeover or identity fraud, and the possibility that sensitive academic or employment information could surface later. For the institution the consequences can include regulatory notification duties, remediation costs, temporary disruption of services and reputational pressure. Because the number of people affected is unknown and the exact data types are unconfirmed, the scale of individual harm cannot yet be quantified. The listing alone does not prove that every file has been published or sold; it does, however, place the claimed data at elevated risk of further exposure.

What to do if you're exposed

If you have a current or past connection to The University of Notre Dame Australia, treat the listing as a prompt for basic hygiene rather than confirmed personal compromise. Practical first steps include:

• Monitor bank, credit and government accounts for unexpected activity and enable any available transaction alerts.
• Change passwords on university-related and personal email accounts, preferably with a password manager, and turn on multi-factor authentication wherever it is offered.
• Be alert to phishing messages that reference the university, enrolment, employment or “data recovery” offers; verify any such contact through official channels.
• Request a free credit report or identity-monitoring service if you believe sensitive identifiers may have been involved, and document any suspicious contacts.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Official guidance from the university or Australian regulators, if issued, should take precedence. Public detail on this incident remains limited; further confirmed information may emerge later.

AICompiled with AI assistance from public sources and published under our editorial standards.