University of Defence - Part 1 Listed by monti Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 27, 2023, the University of Defence appeared on a leak site operated by the monti ransomware group, which claimed the institution as a victim and indicated that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail on the incident is limited to the group's listing and the description of internal files taken.

The listing matters because the University of Defence is a military higher-education institution; any confirmed compromise of its systems could expose sensitive administrative, academic, or operational material and create lasting risk for staff, students, and partners even when exact contents stay unconfirmed.

Breaking down the breach

According to the available record, the University of Defence was listed by the monti ransomware group on September 27, 2023, under the headline noting “Part 1.” The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the precise date the intrusion began, the volume of data taken, or whether encryption was successfully deployed—have been publicly disclosed. The number of individuals affected is recorded as unknown. Beyond the leak-site claim itself, independent confirmation of the full scope has not been provided in the facts available.

The group behind it: monti

Monti is a ransomware operation that became active in the period after the Conti group largely dissolved. Like many successors in that ecosystem, monti has typically followed a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group has historically posted victims on dedicated leak sites, sometimes releasing sample files or staged “parts” of stolen data to increase pressure. Public reporting has associated monti with attacks on a range of sectors, including education and government-linked organisations, though each incident must be assessed on its own evidence. In this case, the sole attribution is the group’s own listing of the University of Defence; that listing constitutes a claim rather than independently verified proof of every asserted detail.

Who is University of Defence?

The University of Defence is a military-oriented higher-education institution. Public background indicates it is connected with engineering and defence-related training; the supplied summary notes that Brno was selected as the location for a new engineering-oriented military college because of the city’s long tradition of high-quality engineering education. Institutions of this type normally manage student and staff records, research materials, administrative correspondence, procurement data, and sometimes information tied to defence education or partnerships. A breach affecting such an organisation is consequential because the data it holds can include both ordinary personal information and material that carries institutional or national-security sensitivity, even when the precise files involved remain undisclosed.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as names, contact details, academic records, financial information, or classified research—has been released. Organisations of this kind typically store personnel files, student information, email archives, internal reports, and operational documents. Because the exact contents have not been confirmed, it is not possible to state what was actually taken. Any assessment of exposure must therefore remain provisional until the university or independent investigators provide further verified detail.

Why it matters

For individuals whose data may have been among the internal files, the practical risks include targeted phishing, identity misuse, or unwanted contact that leverages accurate personal or professional details. For the institution, the consequences can include operational disruption, the need to investigate and remediate systems, potential regulatory notification duties, and reputational harm arising from the mere claim of a successful intrusion. Military-linked universities also face the additional concern that even routine administrative data, once public, can be pieced together with open-source information to map relationships, schedules, or research directions. None of these outcomes require sensational framing; they follow directly from the nature of the data such organisations hold and from the standard tactics of ransomware groups that publish stolen material.

Were you affected?

If you are a current or former student, staff member, or partner of the University of Defence, treat the incident as a prompt to review your exposure rather than as confirmed proof that your own records were taken. Change passwords on any accounts that reused credentials linked to the university, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Official updates, if any are issued by the university, remain the primary source for confirmation of scope and recommended next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.