Ransomware Hits University of Illinois Chicago’s College of Medicine as a New Gang Claims Credit
UIC says a ransomware attack temporarily took down some College of Medicine systems and that data was stolen. A gang called Booba, active since July, has claimed the attack.
The University of Illinois Chicago has become the latest large institution to deal with ransomware. The attack was confined to one college, but it still involved stolen data, systems taken offline and a criminal group eager to take credit.
What the university says happened
UIC recently discovered a ransomware attack that cut off access to some systems at its College of Medicine. A spokesperson told Recorded Future News that the attackers stole some information from the college’s servers, and that an investigation is working out whether any personal, research or academic information was compromised.
The affected systems were temporarily unavailable but have since been restored, according to the university. UIC’s main network was not affected, and patient care at UI Health was not disrupted. The incident was reported to law enforcement, the recovery was coordinated with agencies, and the university plans to notify anyone whose information was taken.
For a sense of scale: UIC is Chicago’s largest university, with more than 35,000 students in 16 colleges. The College of Medicine has about 1,300 students.
The group behind it
A ransomware gang called Booba claimed the attack last week and said it had stolen 344 gigabytes of data. The group appeared at the end of July and has already claimed 49 attacks. SentinelOne’s Brett Williams said Booba looks like a rebrand of the Frag ransomware, based on the style of its leak site and how it negotiates. Files it encrypts get a .booba extension, and there appear to be Linux and Windows versions.
Booba has gone after companies and small county governments as well. Merrimack County, New Hampshire, confirmed to local outlets and DysruptionHub that it dealt with a cyberattack several weeks ago and has recovered. Patch reported that during that attack, county dispatchers could not pull criminal data from the state’s software to share with officers.
Jonathan Greig reported the UIC incident for The Record from Recorded Future News.
What this means for your company
- Segmentation limits the blast radius. UIC says its main network was untouched. Separating departments, sites and critical systems keeps one break-in from becoming a company-wide outage.
- Restoring systems is only half the job. Data was stolen even though systems came back. Plan for both recovery and the possibility of a data leak, including notification duties.
- New gang names don’t mean new tactics. Rebranded groups reuse proven methods. Basics like patching, MFA, tested offline backups and monitoring still stop most of them.
- Small organizations are targets too. This group hits county governments and companies, not just big universities.
Need help segmenting your network and preparing to recover from ransomware? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
