Ransomware Gang Booba Steals 344 GB from University of Illinois Chicago College of Medicine
What Happened — A ransomware group identifying itself as Booba encrypted files on the College of Medicine’s servers and exfiltrated roughly 344 GB of data. The attack rendered several college systems unavailable for a short period, but the university’s main network and patient‑care services remained operational. All affected systems have since been restored and law‑enforcement has been notified.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of endpoint protection and backup integrity is essential to detect ransomware activity before encryption spreads.
- A documented incident‑response workflow, with auditable evidence of detection, containment, and recovery, provides the defensible trail required for regulatory and audit reviews.
- Demonstrating that critical research and academic data are protected aligns with control objectives around data integrity and availability across multiple frameworks.
Who Is Affected – Higher‑education institutions with research and medical programs; any organization that stores sensitive academic or health‑related data on shared campus networks.
Recommended Actions
- Verify that your incident‑response plan includes ransomware‑specific playbooks and that roles are exercised regularly.
- Collect and preserve logs, backups, and forensic artifacts from the affected environment to build audit‑ready evidence.
- Review backup frequency, offline storage, and restoration testing to ensure rapid recovery without paying a ransom.
- Conduct a post‑incident gap analysis and map findings to the relevant control objectives in your compliance framework.
Source: The Record
Technical Notes
- Attack vector: Malware – ransomware payload delivered via an unknown initial access method.
- Data types potentially exposed: personal identifiers, research records, academic information.
- Ransomware family: Booba (re‑branded Frag ransomware) with .booba encrypted file extension; variants for Windows and Linux observed.
Source: The Record