unimore.it Listed by funksec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 12, 2025, the University of Modena and Reggio Emilia, known online as unimore.it, was listed by the funksec ransomware group. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further technical details have not been disclosed.

The listing itself is a claim by the group. For a major Italian public university that holds academic, administrative and research records, any confirmed exposure of internal material carries clear consequences for staff, students and partners. Exact scale and contents are still unconfirmed.

What happened

According to available records, unimore.it was listed by the funksec ransomware group on March 12, 2025. The only concrete description provided is that internal files were allegedly exfiltrated in a ransomware attack. No public confirmation has been issued on the precise date of intrusion, the initial access method, the volume of data taken, or whether systems were encrypted in addition to the theft. The number of individuals potentially affected is listed as unknown. All other operational details remain undisclosed.

The group behind it: funksec

Funksec is a ransomware operation that has appeared in public threat reporting as a double-extortion actor. Groups of this type typically gain access to networks, exfiltrate data, and then threaten to publish it on a dedicated leak site if a ransom is not paid. They often target organisations that hold large volumes of internal documents, including educational institutions. Funksec’s listings are claims made by the group itself; they do not automatically constitute independent verification that every named victim suffered the full extent of the asserted compromise. In this case the only specific assertion tied to unimore.it is the listing and the statement that internal files were taken. No further claims by the group about this particular victim have been recorded in the available facts.

Who is unimore.it?

Unimore.it is the online domain of the University of Modena and Reggio Emilia, a public Italian university founded in 1175. It is one of the oldest continuously operating universities in Europe and maintains faculties across economics, humanities, law, sciences, medicine, pharmacology and social sciences. Like most large research universities it manages student and staff records, research data, administrative correspondence, financial information and systems used for teaching and campus services. A breach affecting such an institution is consequential because the data it holds can include personal identifiers, academic histories, health-related research material and contractual documents involving external partners. Disruption or exposure can affect thousands of current and former students, faculty and administrative personnel.

What was likely exposed

The facts state only that internal files were exfiltrated. No inventory of file types, databases or record counts has been released. Organisations of this kind typically store:

• Student enrolment, grades and contact details
• Staff employment and payroll records
• Research datasets and grant documentation
• Administrative and financial correspondence
• Access credentials and internal system configurations

Whether any of these categories were among the files taken remains unconfirmed. Public detail is limited to the single description “internal files,” so no specific data type can be treated as verified fact.

The real-world impact

For individuals whose information may have been included, the practical risks include targeted phishing that references genuine university correspondence, attempts to reset academic or email accounts, and longer-term misuse of personal identifiers. Staff and researchers could face exposure of unpublished work or sensitive administrative notes. For the university the consequences include potential regulatory notification duties under European data-protection rules, the cost of forensic investigation and system remediation, and the need to communicate with affected communities while details remain incomplete. Because the number of people affected is unknown and the exact contents unconfirmed, the full scope of harm cannot yet be quantified. The listing alone, however, creates an immediate requirement for caution among anyone who has held an account or relationship with the institution.

Were you affected?

If you are a current or former student, staff member or partner of the University of Modena and Reggio Emilia, treat any unexpected messages that reference university systems with scepticism. Change passwords on related accounts, enable multi-factor authentication where available, and monitor financial and academic portals for unusual activity. Because the precise data set is still undisclosed, it is not possible to state with certainty who is or is not included. Readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Stay alert for official notices from the university itself rather than relying solely on third-party claims.

AICompiled with AI assistance from public sources and published under our editorial standards.