Ransomware Attack Disrupts University of Illinois Chicago Medical School Systems
A ransomware attack recently forced the University of Illinois Chicago to take some College of Medicine systems offline, though the main network and patient care at UI Health remained operational. The Booba ransomware gang claimed the intrusion and said it obtained 344 gigabytes of information. The university has since brought the affected systems back online, reported the incident to law enforcement and launched an investigation to establish what personal, research or academic records may have been taken. Anyone whose data was compromised will be notified.
What the University Disclosed
A university spokesperson told Recorded Future News that certain College of Medicine systems were temporarily offline because of the ransomware event but have now been restored. The core university network was not impacted, and there was no interruption to patient care at UI Health.
The university reported the attack to law enforcement and worked with agencies during the recovery. The investigation is still determining whether sensitive records were exposed. Notification letters will go out to individuals whose information was confirmed stolen.
About the Affected Institution
The University of Illinois Chicago is the largest university in Chicago, enrolling more than 35,000 students across sixteen colleges. The College of Medicine has approximately 1,300 students. Precisely what categories of data resided on the compromised servers has not been made public.
Booba Group Claims Responsibility
The Booba ransomware gang claimed credit for the attack last week and said it exfiltrated 344 gigabytes of data. Booba surfaced in late July and has since listed forty-nine victim organizations on its leak site.
Brett Williams, a researcher at SentinelOne, observed that Booba appears to be a rebranding of the Frag ransomware operation, based on similarities in the leak site design and the way the group communicates during ransom negotiations. Files encrypted by Booba are appended with a .booba extension, and the malware includes builds for both Linux and Windows. Victims have included several private companies and small county governments.
Similar Attack on New Hampshire County
Merrimack County, New Hampshire, confirmed to local outlets and DysruptionHub that it experienced a cyberattack several weeks ago and has recovered. The news site Patch reported that during the incident, county dispatchers lost access to criminal records in the state system, preventing them from sharing that information with responding officers.
Steps to Take If Notified of a Breach
Anyone who receives a breach notification from the university should act quickly to limit the potential for identity theft or account takeover. Monitor official updates from the institution as the investigation progresses.
- Check bank and credit-card statements for unfamiliar transactions.
- Sign up for any monitoring or protection service the university offers at no charge.
- Place a fraud alert or security freeze with Equifax, Experian and TransUnion.
- Change passwords for university portals and for any other account that uses the same password.
- Watch for phishing emails that pretend to offer breach details or password resets.
Risk Reduction Measures for Institutions
Educational institutions can reduce exposure by segmenting networks so that a compromise in one department does not spread to core services. Multi-factor authentication on remote access and administrative accounts raises the bar for lateral movement. Maintaining encrypted offline backups, applying patches promptly and rehearsing incident response with tabletop exercises all improve resilience. Smaller institutions that lack a full-time security team should reach out to state or regional cybersecurity centers for threat intelligence and recovery support.
Questions readers ask
Did the attack affect patient care at UI Health?
No. The university stated that patient care delivery at UI Health continued without interruption. The attack impacted certain College of Medicine systems, but the main university network was not affected.
How much data did Booba claim to steal?
Booba claimed to have obtained 344 gigabytes of data from College of Medicine servers. The university is investigating to determine what personal, research or academic information may have been compromised and will notify affected individuals.
When did the Booba ransomware group emerge?
Booba surfaced at the end of July and has since claimed forty-nine attacks. SentinelOne researcher Brett Williams noted that the group appears to be a rebrand of Frag ransomware, judging by the leak site design and negotiation tactics.
Will affected individuals be notified?
Yes. The university plans to notify anyone whose information was stolen once the investigation establishes what data was compromised.
What other organizations has Booba targeted?
The gang has listed several companies and small county governments as victims. Merrimack County, New Hampshire, confirmed it dealt with a Booba attack several weeks ago. During that incident, dispatchers could not retrieve criminal records from the state system to relay to officers.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.