Universidad Internacional Del Ecuador

Summary

A cyberattack targeted a higher education institution in Ecuador, resulting in unauthorized access and exfiltration of sensitive data. The Lockbit ransomware group claimed responsibility, alleging possession of over 213,000 files totaling 150GB, including Excel templates and national identification documents. The attackers published samples of the stolen data on their leak site as proof of compromise. The victim organization did not publicly acknowledge the incident or respond to inquiries about the breach at the time of reporting, with no official notices detected on their digital platforms regarding the security event. The incident involved substantial data theft but lacked confirmed details about operational disruptions or ransom demands.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 21, 2022, the Lockbit ransomware group listed Universidad Internacional Del Ecuador (UIDE) on its data leak site, publicly claiming responsibility for a cyberattack against the institution. Lockbit provided samples of stolen data as proof of compromise, including Excel templates and DNI (Documento Nacional de Identidad) documents. The group asserted possession of 213,605 files totaling 150GB of data exfiltrated from UIDE’s systems. No specific details regarding the initial attack vector, encryption methods, or ransom demands were disclosed by Lockbit in their leak site announcement. DataBreaches.net attempted to contact UIDE for verification of the incident but received no response from the university. Public-facing university channels, including its official website and social media platforms, showed no acknowledgment of a security breach or service disruptions at the time of reporting.

The absence of official statements from UIDE left the full scope of operational impacts unconfirmed, though Lockbit’s data sample suggested compromise of administrative and identity documents. No information emerged regarding UIDE’s detection methods, containment actions, or data recovery processes. Unlike contemporaneous incidents involving other Latin American entities—such as Guatemala’s Ministry of Foreign Affairs, which acknowledged technical disruptions—UIDE maintained public silence on the breach. The university did not clarify whether student, faculty, or financial records were affected beyond the samples exposed by Lockbit. Lockbit’s leak site entry remained active without further updates, and no subsequent communications between the threat actors and external observers were documented. The incident concluded without publicly verifiable resolution from UIDE or independent confirmation of data restoration efforts.

Sources

Sources available to members: 1 source.