University’s Emergency System Hacked by Cybercriminals to Issue Threats towards Students and Faculty

Hackers hijacked Bluefield University’s RamAlert emergency alerts system and threatened to leak admissions data unless the university paid a ransom. The hackers used the system to send messages to students and staff, urging them to pressure the university’s president to meet their demands.

The university’s investigation into the attack found no evidence of financial fraud or identity theft, and it assured faculty and students that it was safe to use its resources.

However, on May 1st, 2023, the Avos ransomware gang still had access to the university’s RamAlert system. The cybercriminals used the system to send out text messages and emails, threatening to leak personal data unless a ransom demand was paid. The university has not disclosed whether it paid the ransom or not. WVVA was the first to report the incident.

The Avoslocker Ransomware gang sent alerts to students and staff at Bluefield University, claiming to have hacked the university network and extracted 1.2 TB files. The group urged recipients not to believe the university’s claims downplaying the severity of the attack and shared links to their data leak site. They planned to leak the first sample on May 1st, 2023.

The Avoslocker ransomware gang used Bluefield University’s hijacked RamAlert system to deliver a final message threatening to publish all stolen data if the university did not pay the ransom. The group released some stolen data, including the President’s W-2 Tax Form, and a document related to their insurance policy. Bluefield University is still restoring its systems, and there is no evidence of student data abuse.

University admitted that their emergency alerts system had been hacked and warned against responding to messages or clicking on links from cybercriminals. Ransomware groups have resorted to various methods of double and triple extortion, including calling partners, emailing customers and competitors, and setting up data leak portals. The use of an emergency alerts system for extortion appears to be a new tactic, highlighting the extreme lengths ransomware actors will go to increase their leverage.