uatf.edu.bo Listed by stormous Ransomware Group

On November 16, 2024, the Bolivian public university UATF appeared on the leak site operated by the Stormous ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, exposing personal data of students including addresses and phone numbers as well as internal correspondence belonging to employees and students. The number of affected individuals has not been disclosed.

Details in the Leak-Site Listing

The Stormous leak site, accessible via the onion address hosted on ransomware.live, claims that internal files were exfiltrated after the group deployed ransomware against the Universidad Autónoma Tomás Frías. The posting does not quantify the volume of records taken, nor does it list every data type in detail. It does indicate that the material includes student personal data such as addresses and phone numbers, along with internal emails and messages involving both staff and pupils. No ransom demand figure is published on the page, and the listing does not state when the initial intrusion occurred or how long the attackers remained inside the network.

Why This Matters for You and Your Family

If you or any member of your family studied, worked, or corresponded with UATF, your contact details and private messages may now sit in a criminal archive. Addresses and phone numbers are high-value building blocks for identity theft, loan fraud, and targeted scams. Internal correspondence can reveal personal relationships, health matters, financial references, or disciplinary notes that criminals can weaponize for blackmail or social-engineering attacks. Because universities routinely hold records for current students, alumni, and their families, the exposure can affect multiple generations from a single household.

The Doxxing and Identity-Chain Risk

Once names, addresses, and phone numbers leave an institutional server they rarely stay isolated. Attackers and data brokers routinely link them to usernames, email addresses, and gaming handles. A student’s leaked phone number can be tied to a Discord or Roblox account; an employee’s internal email can surface on paste sites months later. These chains allow criminals to map one identity across dozens of online services. Credential leaks of this kind frequently cascade into account takeovers that expose even more personal material, turning a single breach into a long-term doxxing pipeline. Stormous has a documented habit of publishing compressed archives that researchers and other criminals can freely download, accelerating that exposure.

Stormous Ransomware Group Track Record

Public reporting attributes the first major activity by Stormous to late 2021. The group has since listed hundreds of organizations across education, healthcare, and local government sectors. Notable prior victims include schools and universities in Latin America and the Middle East. Their typical playbook begins with phishing or exploited remote-access tools for initial access, followed by exfiltration of sensitive files before encryption. Stormous then demands payment and, if unpaid, publishes samples or full archives on their leak site. They frequently update listings with countdown timers and occasionally offer “proof” packages to pressure victims. The group’s willingness to leak student and employee correspondence fits their established pattern of maximizing embarrassment when ransom is refused.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at uatf.edu.bo wherever it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or phone number.
• Let remediation specialists handle data-broker takedown requests and correspondence removal on your behalf while you focus on securing accounts.

The incident shows once again that data held by educational institutions can reach criminal forums without warning. A forward-looking defense requires more than changing one password; it demands ongoing visibility into how your identity appears across the breach ecosystem. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this claimed breach has opened.