unisi.it Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public institutions across Europe, treating universities as high-value sources of internal records and operational data. In this landscape, the appearance of a long-established Italian university on a leak site is a reminder that academic networks remain attractive to financially motivated actors who combine encryption with data theft.

On 5 May 2024 the University of Siena, known as unisi.it or Università degli Studi di Siena, was listed by the lockbit3 ransomware group. The group claims to have stolen 514 gigabytes of internal files. The number of people affected remains unknown, and public detail on the precise method of intrusion is limited. The incident matters because universities hold administrative, financial and personal records whose exposure can affect staff, students and partner organisations.

What happened

According to the available record, lockbit3 listed unisi.it on its leak site on 5 May 2024. The group asserts that it carried out a ransomware attack and exfiltrated 514 gigabytes of internal files. Among the material described are documents containing budgets and expenses. No confirmed figure has been released for the number of individuals whose data may be involved, and the exact timeline of the intrusion, the initial access vector and whether systems were encrypted remain undisclosed in the public summary. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every detail.

Inside lockbit3

Lockbit3 is a well-documented ransomware operation that has operated as a ransomware-as-a-service model, allowing affiliates to deploy its tools against selected targets. The group typically gains access through phishing, compromised credentials or unpatched remote services, then moves laterally, steals data and encrypts systems before posting victims on a dedicated leak site if a ransom is not paid. Its public activity has included numerous listings of organisations across education, government and private sectors. In this case the group claims responsibility for the University of Siena listing and the associated data theft; no further statements specific to this victim beyond the volume and general nature of the files have been provided in the available facts.

unisi.it and its sector

The University of Siena is one of Italy’s oldest publicly funded universities, located in Siena, Tuscany. Like other higher-education institutions it maintains extensive administrative systems covering finance, human resources, student records, research administration and facilities management. Universities routinely process personal data of students and staff, contractual and budgetary information, research materials and correspondence with external partners. A breach at such an organisation is consequential because the data often combine sensitive personal identifiers with institutional financial and operational detail, and because academic networks frequently interconnect with national research infrastructures and public funding bodies.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack and that 514 gigabytes of material were taken, including documents with budgets and expenses. No complete inventory of file types or data categories has been published, and the number of affected individuals is unknown. Organisations of this kind typically hold payroll and personnel files, student enrolment and academic records, financial ledgers, procurement documents, research proposals and internal correspondence. Because the exact contents remain unconfirmed beyond the partial description given, it is not possible to state with certainty which specific categories were present in the stolen volume.

What's at stake

For individuals whose information may have been included, the principal risks are identity misuse, targeted phishing that references real institutional details, and potential exposure of financial or employment-related data. Staff and students could face follow-on social-engineering attempts that appear more credible because they draw on genuine internal documents. For the university the stakes include operational disruption, the cost of forensic investigation and system recovery, possible regulatory scrutiny under European data-protection rules, and reputational damage that can affect recruitment and partnerships. Even when encryption is reversed or systems are restored from backups, the prior exfiltration of data leaves a lasting exposure that cannot be undone by technical recovery alone.

Were you affected?

Anyone connected to the University of Siena—current or former students, staff, contractors or research partners—should treat the possibility of exposure seriously until more detail emerges. Practical first steps include monitoring bank and credit accounts for unusual activity, enabling multi-factor authentication on email and university-related accounts, and treating unsolicited messages that reference university business with caution. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. If official notifications are issued by the university or Italian authorities, follow the guidance they provide and retain any reference numbers for future correspondence.

AICompiled with AI assistance from public sources and published under our editorial standards.