A ransomware group called Booba Project claims to have stolen 344GB of data from the University of Illinois Chicago. The university has not publicly confirmed the breach or named affected individuals. If you are a current or former student, faculty, or staff member, monitor your credit reports and watch for phishing emails referencing the university.
| Company | University of Illinois Chicago |
|---|---|
| Industry | Education |
| Data Types Exposed | Names and Contact Information, Student Records, Employee Personnel Records, Financial Aid Information, Social Security Numbers, Academic Transcripts |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the University of Illinois Chicago Data Breach?
A ransomware group calling itself Booba Project has claimed responsibility for a cyberattack targeting the University of Illinois Chicago. According to the group’s own claims, roughly 344 GB of data was stolen from the university’s systems. As of now, the University of Illinois Chicago has not publicly confirmed this incident.
Because this report stems from a threat actor’s leak-site listing, many details remain unverified. The exact timeline of the intrusion has not been publicly disclosed. Similarly, the specific method used to breach the university’s network has not been confirmed by any official source.
In cases like this, extortion groups often post claims to leak sites before the victim organization issues any statement. As a result, independent verification of the stolen data’s contents is still pending. Until the university or an independent forensic investigator confirms details, affected individuals should treat the claim seriously but understand that official information is limited.
Who was affected?
The population affected by this alleged breach has not been publicly disclosed. Given that the target is a major public university, the people impacted could include current students, former students, faculty, and staff. Because universities store data across many departments, the scope could be broad.
Higher education institutions typically hold records tied to admissions, financial aid, payroll, and health services. This means both adults and, in some cases, minors enrolled in affiliated programs could be included. However, without an official statement, the precise number of affected individuals and their specific roles at the university remain unknown.
What Information Was Potentially Exposed?
Since the University of Illinois Chicago has not released an official list of compromised data, the exact categories remain unconfirmed. However, based on the type of information typically held by large universities and referenced in similar claims, the following categories are commonly at risk in attacks like this one.
- Names and contact information
- Student records and enrollment details
- Employee personnel records
- Financial aid or billing information
- Possible Social Security numbers
- Academic transcripts
If personal identifiers such as Social Security numbers or financial details were indeed included in the stolen 344 GB, affected individuals could face a heightened risk of identity theft. Criminals often use this type of data to open fraudulent credit accounts or file false tax returns. In addition, stolen academic records could be used for targeted phishing attempts.
Even if only names and contact details were exposed, this information still carries risk. For example, scammers frequently use such details to craft convincing phishing emails impersonating the university. Because students and employees may not expect this type of fraud, these attempts can be especially effective.
What is the company doing?
Because this incident has only been claimed by the Booba Project threat actor group, there is currently no confirmed public statement from the University of Illinois Chicago regarding an investigation or remediation steps. The university has not publicly confirmed the breach, and therefore no notification timeline or protective service offering has been disclosed at this time.
As more information becomes available, official confirmation would typically include details about any forensic investigation, credit monitoring offers, and notification letters sent to affected individuals. Until such a statement is made, impacted individuals should rely on verified university communications channels for updates rather than third-party claims.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should regularly review their credit reports for unfamiliar accounts or inquiries. You can request free reports from each of the three major credit bureaus through AnnualCreditReport.com.
Monitoring early helps catch fraudulent activity before it causes lasting damage. Because identity thieves sometimes wait months before using stolen data, continued vigilance over the coming year is important.
Consider a Fraud Alert or Credit Freeze
If Social Security numbers or financial details were part of the stolen data, placing a fraud alert or credit freeze is a strong protective step. A fraud alert requires creditors to verify your identity before opening new accounts in your name.
A credit freeze goes further by restricting access to your credit file entirely. This makes it much harder for criminals to open new lines of credit. You can request either option directly through Equifax, Experian, or TransUnion.
Watch for Phishing Attempts
Because this breach may involve university-affiliated contact information, phishing emails impersonating the school are a real risk. Be cautious of messages asking you to verify account details or click unfamiliar links.
Always verify communications through official university channels before responding. If something feels urgent or unusual, that is often a sign of a phishing attempt rather than a legitimate request.
Keep Records and Seek Legal Guidance
It’s wise to save any notification letters, emails, or communications related to this incident. These records can be useful if you need to dispute fraudulent charges later.
In addition, consulting a data breach attorney can help clarify your legal options. Many firms offer free case evaluations to determine whether affected individuals may be eligible for compensation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.