MRC Prion Unit and Institute of Prion Diseases Listed by crypto24 Ransomware Group

On January 24, 2026, the Medical Research Council Prion Unit and the Institute of Prion Diseases appeared on the leak site of the crypto24 ransomware group. The attackers claim to have exfiltrated internal files and state that full data will be released once their timer expires. Anyone whose personal information, medical records, or employment details sit inside those systems could now face exposure.

What's Publicly Reported from Reporting

Public reporting on the ransomware.live portal states the listing of both UK-based research institutions. The crypto24 group posted a notice indicating that internal files were exfiltrated during a ransomware incident. No exact victim count has been disclosed, and the precise volume or sensitivity of the stolen data remains unclear from available reporting. The group’s typical pattern is to set a deadline after which samples or full datasets are published if ransom demands are not met.

Why This Matters for You and Your Family

Medical research facilities hold detailed records that often include names, addresses, dates of birth, contact information, and sometimes health histories of patients, study participants, employees, and their families. If your or your family member’s data was part of any prion disease study, clinical trial, or staff file, it could surface publicly. Once personal details leave secure environments, they rarely return to obscurity. Credential leaks from such breaches frequently cascade into account takeovers across email, banking, and social media.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at publishing raw files. They or opportunistic criminals scrape names, emails, phone numbers, and any linked accounts to build detailed profiles. These identity chains can connect professional emails to personal social media, children’s gaming usernames, and home addresses. A single exposed research record can therefore lead to doxxing campaigns, phishing attempts, or harassment that reaches every member of a household. Available reporting describes how such leaks often fuel follow-on extortion against individuals long after the initial corporate incident fades from headlines.

Crypto24 Group Track Record

Public reporting attributes crypto24 with emerging in recent years as a ransomware operator that combines encryption with data theft. The group has listed healthcare, education, and research targets among its victims. Their publicly observed playbook typically involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files, deployment of ransomware, and dual extortion: demanding payment to prevent both system encryption and public release of stolen data. Exact prior victim counts and success rates are difficult to verify, but industry trackers note their consistent use of leak sites to pressure organizations.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see exactly what chains exist before criminals exploit them.
• Rotate any password used at the MRC Prion Unit or Institute of Prion Diseases anywhere else it appears, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into takeovers and doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts and alerting affected family members.

The incident underscores that research institutions are now routine targets and that any breach of personal records can quickly escalate into long-term privacy and safety risks for ordinary families. Start your DoxxScan trial today and pair it with hands-on remediation by specialists who manage the cleanup across platforms while providing household-wide coverage, including children’s gaming accounts that frequently link back to the same exposed identities. Acting promptly limits how far attackers and opportunists can travel down the identity chain.