www.unige.it Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out universities and research bodies, drawn by the volume of personal and institutional data they hold and the pressure such organisations face to restore operations quickly. Against that backdrop, the University of Genoa’s public web presence, www.unige.it, appeared on a RansomHub leak site on 9 September 2024. The listing itself is a claim by the group; independent confirmation of the full scope remains limited. For students, staff and partners, the episode underscores how educational institutions have become routine targets in the current threat landscape.

Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and further technical detail has not been released. What follows is a factual account of what is known, the actor involved, and the practical implications for those connected to the university.

What happened

On 9 September 2024, the domain www.unige.it was listed by the RansomHub ransomware group. According to the available summary, the incident involved the exfiltration of internal files as part of a ransomware attack. No public figure has been given for the volume of data taken, the precise date of intrusion, or the initial access method. The number of individuals potentially affected is listed as unknown. Beyond the group’s claim on its leak site and the statement that internal files were removed, further operational details remain undisclosed.

The group behind it: ransomhub

RansomHub is a ransomware-as-a-service operation that became active in early 2024, attracting affiliates after the disruption of other major groups. It typically employs double-extortion tactics: encrypting systems while simultaneously copying data and threatening to publish it if a ransom is not paid. The group maintains a dedicated leak site where it posts victim names and, in some cases, sample files to increase pressure. Affiliates handle initial access and deployment, while the core operators manage negotiations and infrastructure. RansomHub has claimed responsibility for attacks across multiple sectors, including education and public research. In this instance the group claims to have listed the University of Genoa; that claim has not been independently verified in the public record provided here, and no specific ransom demand or publication timeline for this victim has been detailed beyond the listing itself.

Who is www.unige.it?

www.unige.it is the public web address of the University of Genoa (Università degli Studi di Genova), a long-established public research university in Genoa, Italy. Founded in 1481, it offers undergraduate, graduate and doctoral programmes across humanities, sciences, engineering, medicine and related fields. Like most large European universities it maintains extensive digital systems for student records, research data, administrative correspondence, staff information and international collaborations. A breach affecting such an institution is consequential because universities hold both personal data of large numbers of people and research materials that may have commercial or privacy value. The university’s role as a public research body also means any disruption can affect teaching, grant-funded projects and partner organisations.

What was likely exposed

The only data type named in the available facts is “internal files” exfiltrated during the ransomware attack. No further breakdown—such as student records, employee details, research datasets or financial documents—has been publicly confirmed. Organisations of this kind typically store enrolment and academic records, staff personnel files, email archives, research documentation and administrative correspondence. Because the precise contents remain unconfirmed, it is not possible to state which of these categories, if any, were included. Readers should treat any more specific claims circulating online as unverified unless corroborated by the university or competent authorities.

What's at stake

For individuals whose information may have been among the internal files, the principal risks are identity misuse, phishing that leverages accurate personal details, and long-term exposure of contact or academic data. Staff and researchers could face similar concerns if personnel or project files were involved. For the university itself, the stakes include operational disruption, potential regulatory scrutiny under European data-protection rules, reputational impact, and the cost of investigation and remediation. Because the number of people affected is unknown and the exact data types unconfirmed, the scale of these risks cannot yet be quantified. The incident nevertheless illustrates the concrete pressure ransomware places on educational institutions that must balance openness with security.

Were you affected?

If you are a current or former student, staff member or partner of the University of Genoa, monitor official communications from the university for any notification or guidance. Change passwords on university-related accounts, enable multi-factor authentication where available, and remain alert for unsolicited messages that reference personal or academic details. You can also run a free exposure scan of your email address to check whether it has appeared in known breach datasets. Such a scan does not confirm involvement in this specific incident, but it can indicate whether your credentials or personal information have already circulated more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.