itca.edu.sv Listed by safepay Ransomware Group

On December 21, 2024, the Salvadoran higher-education institution ITCA appeared on the leak site operated by the safepay Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack; the number of affected individuals and the precise volume or types of records remain unknown because the disclosure provides no further detail.

Primary Disclosure Details

The safepay leak site entry, first observed on December 21, 2024, states that ITCA.edu.sv suffered a ransomware intrusion in which attackers successfully copied internal files before encryption. The listing does not quantify the number of records, name the specific systems compromised, or itemize the data categories taken. It simply states that exfiltrated material is available for review by authorized parties on the extortion portal. Revenue figures sometimes attached to such listings, in this case $56.5 million, typically reflect the victim organization’s estimated annual turnover rather than ransom amounts demanded.

Why This Matters for You and Your Family

Even when a breach originates at a university or technical institute, ordinary people are often the ones placed at risk. Students, alumni, faculty, staff members, and their families frequently have personal information stored in institutional systems: application forms, transcripts, employment records, tax identifiers, and contact details. If those files have left the organization’s control, the exposure can follow you long after graduation or employment ends. A single leaked record can supply the seed data that links your email address, phone number, and physical address across dozens of other services.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at publishing a single compressed archive. Once internal files are in their possession, the data can be parsed for names, dates of birth, national identification numbers, and email addresses that appear in spreadsheets, PDFs, or database exports. Those fragments become the starting point for doxxing chains: an attacker or downstream buyer cross-references the leaked material with information already circulating on criminal forums, gaming platforms, and social-media scrapes. The result is a detailed profile that can be used for identity theft, targeted phishing, or harassment. Credential leaks of this nature also cascade into account takeovers on personal and children’s gaming accounts that reuse the same passwords or recovery email addresses.

Safepay Ransomware Group Track Record

Public reporting attributes the Safepay group with emerging in mid-2024 as a double-extortion operation that combines file encryption with public data leaks. The actors have listed dozens of organizations across Latin America, Europe, and North America, typically giving victims a short window to negotiate before releasing samples or full datasets. Their playbook commonly begins with phishing or exploitation of remote-access software, followed by lateral movement inside the network, exfiltration of documents, and deployment of ransomware. The group maintains a leak site that functions both as a shaming platform and a marketplace for harvested data, a pattern consistent with several mid-tier ransomware collectives active in the past eighteen months.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at ITCA.edu.sv or related institutional services, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts often chained to the same address or recovery details.
• Let remediation specialists handle repeated takedown requests across data-broker sites that resurface leaked personal information.

The incident underscores that ransomware listings continue to surface weeks or months after initial compromise, making proactive discovery essential. One short forward-looking step can limit how far stolen data travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.