University of Salerno Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 30, 2023, the University of Salerno was listed by the ransomware group known as rhysida. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and many operational details have not been disclosed.

The listing places the Italian university among organisations whose data the group claims to have taken. For students, staff, alumni and partners, the incident raises practical questions about what information may have left the institution’s systems and what steps are reasonable in response while fuller confirmation is still limited.

What happened

According to available public information, the University of Salerno appeared on a rhysida-associated listing dated June 30, 2023. The report characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure for the number of individuals affected has been released, and specifics such as the precise intrusion method, the duration of unauthorised access, the total volume of data taken, or any ransom demand remain undisclosed in the material provided.

Because the primary public signal is the group’s own listing, the claim that the university was successfully compromised and that files were removed should be treated as an assertion by the threat actors rather than as independently verified detail. No further technical indicators or official institutional confirmation beyond the reported listing and the description of internal-file exfiltration are contained in the facts at hand.

The group behind it: rhysida

Rhysida is a ransomware operation that emerged in public reporting in 2023 and has been observed using double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. The group typically maintains a leak site on which it names victims and, in some cases, releases sample files or larger archives to increase pressure. Like other ransomware crews of this period, rhysida has targeted a range of sectors, including education, healthcare and public services, often relying on initial access through compromised credentials, exposed remote services or unpatched vulnerabilities before deploying its payload.

In this instance, the group’s listing of the University of Salerno constitutes its claim of responsibility and of data theft. No additional statements attributed to rhysida about this specific victim—such as deadlines, ransom amounts or detailed file inventories—are included in the reported facts. Established public knowledge of the group’s general methods should not be read as confirmed particulars of the Salerno incident.

Who is University of Salerno?

The University of Salerno is a public university in Italy with its main campus in Fisciano and the Faculty of Medicine located in Baronissi. Like other higher-education institutions of its size, it manages academic records, research materials, administrative systems, staff and student personal data, and the supporting IT infrastructure required for teaching, research and campus operations.

A breach affecting a university is consequential because such organisations hold information on large, rotating populations of students and employees, often retain records for many years, and may also store research data, financial details and correspondence with external partners. Disruption or exposure can affect academic continuity, individual privacy and institutional trust even when the precise scope of an incident is still being established.

What data was at risk

The reported facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of data types—such as specific categories of personal records, credentials, research datasets or financial documents—has been disclosed. The number of people whose information may be involved is listed as unknown.

Universities typically maintain student enrolment and academic records, staff personnel files, contact details, authentication data, email and document repositories, and sometimes health-related or financial information connected to campus services. It is reasonable to note that these categories are commonly present in higher-education environments; however, whether any particular class of data was among the internal files taken in this case remains unconfirmed. Readers should treat exact contents as unverified until authoritative sources provide additional clarity.

Why it matters

When internal files leave an organisation through a ransomware incident, the practical risks for individuals can include unwanted contact, attempts at fraud or identity misuse, and the longer-term circulation of personal or professional information if the data is later published or sold. For the university itself, consequences may involve operational disruption, the cost of investigation and remediation, regulatory notification duties under applicable privacy law, and reputational effects among students, staff and partners.

Because the scale and precise contents remain undisclosed, the degree of exposure for any single person cannot be stated with certainty. The incident still underscores the value of monitoring for unusual account activity and of treating unsolicited communications that reference university affiliations with caution. Institutions in the education sector are frequent targets precisely because of the volume and sensitivity of the data they hold; a listing by a group such as rhysida therefore warrants measured attention rather than either dismissal or alarm.

If your data was in this claimed breach

If you have a past or present connection to the University of Salerno—as a student, employee, alumnus or partner—consider basic protective steps. Change passwords on related accounts, especially if you reused credentials elsewhere, and enable multi-factor authentication where it is available. Monitor financial and email accounts for unexpected activity, and be sceptical of messages that claim to relate to the incident and request personal information or payment. Official guidance, if issued by the university, should take precedence over informal reports.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it can indicate whether your details appear in previously compiled collections and help you prioritise further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.