School of Oriental and African Studies (SOAS) Targeted by Vice Society in a Ransomware Attack

The School of Oriental and African Studies (SOAS), a distinguished component of the University of London known for its comprehensive undergraduate and postgraduate degrees in languages, cultures, and linguistics, has recently fallen victim to a ransomware attack orchestrated by the Vice Society. This cybercriminal group has compromised and subsequently leaked sensitive data from the institution on its dark web leak site.

This incident at SOAS is not isolated but part of a broader offensive by Vice Society, which has targeted 14 UK schools, including notable institutions like Pates Grammar School in Gloucester and Durham Johnston Comprehensive School. Vice Society's modus operandi involves attacks predominantly within the education sector, as evidenced by their previous significant breach involving the Los Angeles Unified School District, where they exfiltrated 500 gigabytes of data.

The group employs double extortion tactics, a method where they not only demand ransom payments but also threaten to publish stolen data if the negotiations come to a halt. This approach has become increasingly aggressive as victims are more frequently refusing to comply with ransom demands, leading to the unauthorized disclosure of sensitive information.

The education sector's vulnerability to cyberattacks stems from the extensive amounts of sensitive data stored within school and university systems, compounded by insufficient cybersecurity measures and the extensive network of devices accessing these systems. The UK's Information Commissioner's Office (ICO) is currently investigating the SOAS incident, which may lead to penalties under the General Data Protection Regulation (GDPR).

In light of the escalating threat posed by ransomware attacks, cybersecurity experts are advocating for the fortification of endpoint security within the education sector. They stress the necessity of significant investments in cybersecurity infrastructure to safeguard the sensitive personal information that is exchanged and stored throughout the educational process.

Sources

• Infosecurity Magazine: UK Schools Hit by Mass Leak of Confidential Data
• GDPR for schools blog: Schools Across the UK Crippled by Ransomware
• CIO Axis: Vice Society Hacking Group Target 14 Schools in United Kingdom with Ransomware
• Computer Weekly: Vice Society cyber gang targeted multiple UK schools