zewailcity.edu.eg Listed by stormous Ransomware Group

Zewail City of Science and Technology was listed on the Stormous ransomware group’s leak site on December 21, 2023. The Egyptian nonprofit research institution, known for its work in science, technology, and innovation, is claimed to have had internal files exfiltrated during a ransomware attack. The leak-site listing does not specify the number of affected individuals or the exact volume of data taken, leaving current and former students, faculty, staff, and research partners uncertain about their personal exposure.

Reported Details from the Listing

The Stormous leak page states that Zewail City suffered a ransomware incident in which internal files were successfully exfiltrated. No sample data is publicly shown on the page, and the disclosure does not quantify records or name specific document types beyond “internal files.” The listing appeared on December 21, 2023, on the group’s onion site, with the mirror indexed by ransomware.live at the provided .onion address. As is common with many ransomware operators, the group has not publicly detailed the initial access vector or the precise deadline for any ransom demand.

Why This Matters for You and Your Family

If you or any member of your family attended, worked at, or collaborated with Zewail City, your personal information may now sit in an attacker’s archive. Even when exact record counts remain unknown, internal files from a university environment frequently contain names, national ID numbers, contact details, academic records, employment contracts, and financial information. Once such data leaves institutional control, it can surface on additional criminal forums, enabling identity theft, loan fraud, or targeted phishing years later. Families in Egypt and those with relatives studying abroad are particularly exposed because academic institutions often hold records for multiple generations and international students.

Doxxing and Identity-Chain Risks

Leaked academic and employment records rarely stay isolated. Attackers routinely combine them with other breaches to build detailed profiles linking email addresses, phone numbers, family relationships, and online handles. A single university file can expose a student’s parent contact information, residential address, and research project details that reveal travel patterns or affiliations. These chains accelerate doxxing: once an attacker maps one credential to a real person, they can pivot to gaming accounts, social media, or financial services that reuse the same password or security questions derived from academic history.

Stormous Group Track Record

Public reporting attributes Stormous with emerging in early 2021 as a ransomware-as-a-service operation that targets organizations across multiple countries. The group has claimed responsibility for attacks on healthcare providers, educational institutions, and government-adjacent entities, often following a double-extortion model of encrypting systems while simultaneously threatening to publish stolen data. Their typical playbook begins with phishing or exploitation of remote-access tools for initial access, followed by exfiltration of documents before encryption. Stormous maintains an active leak site where they publish victim names and, in some cases, proof files, applying pressure through public embarrassment and the risk of further data resale.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, academic usernames, and real-world identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Zewail City of Science and Technology and enable 2FA with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become takeover targets when academic credential leaks create doxxing chains.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise require weeks of manual effort.

The incident underscores that academic institutions remain high-value targets whose data compromises can affect entire families for years. Starting with a clear picture of your current exposure is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks.