Tor Vergata Listed by pysa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Tor Vergata was listed on the leak site operated by the pysa ransomware group on 9 September 2021. The group claims to have exfiltrated internal files during a ransomware attack. No figure for the number of people affected has been published, and the university has not confirmed the scope or contents of any data taken. The incident is notable because Tor Vergata is a large public university whose systems contain records on students, staff and research activities. Any confirmed exposure of such records would affect individuals over an extended period.

Inside the incident

The only confirmed public information is the listing itself. The pysa group posted Tor Vergata on its leak site and stated that internal data had been removed. No date of intrusion, volume of data, or encryption status has been disclosed by either the group or the university. It remains unknown whether any data was published or whether the university paid a ransom.

The group behind it: pysa

Pysa is a ransomware operation that has been publicly tracked since 2020. Like several other groups of the same period, it combines encryption of victim systems with the threat of releasing stolen files if a ransom is not paid. The group maintains a site where it lists organisations it claims to have targeted. Such listings are assertions made by the group and are not independently verified at the time they appear.

Who is Tor Vergata?

Tor Vergata is the University of Rome Tor Vergata, a public research university in Italy. Institutions of this type maintain large volumes of personal and administrative records, including student enrolment data, staff employment files, financial information and research documentation. A breach at such an organisation therefore involves data that can remain relevant for years after an individual has left the institution.

What data was at risk

The listing refers only to “internal files.” No inventory of specific record types or file categories has been released. Universities routinely hold names, contact details, academic records, identification numbers and limited financial information. Without confirmation from the university or forensic reporting, the precise contents of any exfiltrated material cannot be stated.

The real-world impact

Individuals whose records may have been copied face the possibility that their personal details could be used for targeted fraud or identity misuse. The university faces operational disruption, potential regulatory scrutiny under Italian and European data-protection rules, and the cost of investigating and remediating the intrusion. Both effects unfold over months rather than days.

What to do if you're exposed

Anyone who studied or worked at Tor Vergata around the time of the incident should treat their university-linked email and any associated accounts as potentially known to third parties. Practical first steps include changing passwords on those accounts and enabling multi-factor authentication where available. It is also advisable to monitor bank and government-service accounts for unusual activity and to request a credit report if financial details were stored by the university.

• Change passwords for any Tor Vergata-linked accounts and enable multi-factor authentication.
• Review recent statements from banks or public services for signs of misuse.
• Request a copy of your personal data from the university under applicable data-protection law.
• Run a free exposure scan of your email address against known breach data to check for further appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.