unimore.it Listed by funksec Ransomware Group

On March 12, 2025, the Italian university Unimore.it appeared on the leak site of the funksec ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, and the university’s data is now publicly listed, putting students, staff, alumni, and their families at risk of identity theft and doxxing.

What's Publicly Reported from Reporting

Public reporting indicates that funksec posted Unimore.it on its dark-web leak site on March 12, 2025. The university, officially known as the University of Modena and Reggio Emilia, had internal files stolen in a ransomware incident. The exact number of people affected remains unknown, but the breach involves sensitive institutional records that routinely contain personal information such as names, contact details, dates of birth, and possibly financial or academic records. No confirmed timeline of the initial intrusion has been released, and the university has not yet issued a detailed public statement on the volume or exact categories of data exposed.

Why This Matters for You and Your Family

If you or anyone in your household attended, worked at, or applied to the University of Modena and Reggio Emilia, your personal information may now be in attackers’ hands. Internal files from universities commonly include addresses, phone numbers, email accounts, and student IDs. Once leaked, this data can be sold or used to target you with phishing, account takeovers, or identity fraud. Children or grandchildren who studied there may have their early academic records exposed, which can later link to current addresses, workplaces, or gaming profiles. Even if you are not certain your data was included, the uncertainty itself creates stress and forces you to spend time monitoring accounts that could suddenly be at risk.

The Doxxing and Identity-Chain Implications

A single university breach rarely stops at one record. Attackers chain information across multiple leaks to build complete profiles. An email from your Unimore days might match a password reused on social media, a streaming service, or your child’s gaming account. This creates an identity chain that leads directly to your current home address, phone number, and family members’ names. Public reporting shows that credential leaks of this type frequently cascade into doxxing campaigns, where personal details are published to harass or extort victims. Gaming accounts are especially vulnerable because children and teens often reuse simple passwords or email addresses tied to school records, turning one institutional breach into a direct route to family doxxing.

Funksec Group’s Known Track Record

Public reporting attributes the attack to the funksec ransomware group. The group emerged in late 2024 and has targeted organizations across education, healthcare, and small-to-medium businesses. Notable prior victims include other academic institutions and municipal entities whose internal files were posted after ransom demands went unmet. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files, encryption of systems, and publication of stolen data on their leak site when victims refuse to pay. The group’s extortion style relies on timed deadlines and the threat of incremental data releases to pressure organizations and indirectly harm individuals whose records are exposed.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what the Unimore breach connects to.
• Rotate any password you ever used at the university anywhere it has been reused, and immediately enable two-factor authentication with an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same school email or address.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing accounts.

The Unimore breach is a reminder that institutional leaks continue to expose ordinary families long after the initial headlines fade. Taking concrete steps now can break the identity chain before criminals exploit it. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes your children’s gaming accounts. Start protecting what matters most today.