The computer systems of La Sapienza in Rome, one of the largest universities in Europe with around 120,000 students, have been down for three days following an apparent ransomware attack. In posts on Instagram published Tuesday, the university stated that it took its systems offline as a precaution following the cyberattack. It is investigating the incident and working to restore all digital services, noting that some communication channels like email and workstations are currently partially limited.
The school confirmed it is working to restore systems from backups, which were not affected by the hack. As of this writing, the Sapienza website remains down. Italian daily news outlet Il Corriere della Sera reported this week that the disruption is due to a ransomware attack, something the school nor other authorities have officially confirmed. According to the report, the hackers sent the university a link to a ransom demand with a 72-hour countdown that would only begin once the link was clicked.
In a follow-up article on Wednesday, Il Corriere reported that the hacking group behind the attack is called “Femwar02,” a previously unknown group. The gang reportedly used the BabLock malware, which was discovered in 2023 and is also known as Rorschach.
La Sapienza has stated that exams are proceeding as normal, though students must sign up for exams directly with their professors. The school has also set up physical “infopoints” across campus to provide information to students.
La Sapienza did not respond to a request for comment sent via email. It is unclear if the university is currently able to receive emails. Spokespeople for Italy’s national cybersecurity agency, the Agenzia per la Cybersicurezza Nazionale, which is investigating the incident, did not immediately respond to a request for comment.
Like other organizations, universities and schools are frequent targets for hackers. Last year, the notorious hacking group ShinyHunters breached Harvard University and the University of Pennsylvania, stealing data in an effort to extort the schools. The hackers revealed this week that the schools did not pay the ransom.