Skip to content

Florida Memorial University cyber incident

Summary

Florida Memorial University logo

Florida Memorial University shut off network access after detecting unauthorized activity March 9, 2024. Its July notice reported possible acquisition of personal information, while earlier INC Ransom allegations included posted document samples; encryption, the full data scope and the restoration date remain unconfirmed.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Critical infrastructure sector

Incident characteristics

Assessments

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

Incident narrative

Florida Memorial University shut off network access after detecting unauthorized activity on March 9, 2024. The private university in Miami Gardens, Florida, later notified individuals that personal information might have been acquired. The interruption is documented, while its duration and the full extent of data compromise remain uncertain.

Analyst assessment

The university’s July 29 notification confirms unauthorized access and immediate network isolation, followed by a specialist forensic investigation. Its electronic review concluded June 27 and identified possible acquisition of recipients’ names, birth dates and Social Security numbers. The letter describes a potential acquisition finding rather than a definitive accounting of everything removed.

Comparitech’s March 28 report establishes public cyber-specific reporting before the July notice: INC Ransom claimed the university and posted alleged document samples. That dated report supports the early public-evidence chronology independently of when a tracker discovered the listing. The university’s notice does not identify INC Ransom or confirm encryption.

Operational significance

Shutting off all network access established an availability interruption and a containment response. The public record does not identify each affected application, canceled class or closed campus facility. June’s document-review completion and July’s notification are later investigative and disclosure milestones, rather than evidence that the network remained offline for those months. No precise restoration date is established.

Confidence and uncertainty

Confidence is high in unauthorized access and isolation because the university directly acknowledged both. Confidence is lower in the claimed data scope and named-actor responsibility. Comparitech reported scans of passports, Social Security information and contracts posted as alleged evidence; that report does not independently authenticate every document or identify all affected people. The university said it had received no reports of misuse as of its notice, which does not negate the underlying exposure risk.

The INC Ransom tracker entry names the institution and uses fmu.edu, a domain now used by its official website. The listing remains an allegation, and current domain ownership does not establish every historical technical detail.

Analytic gaps

The initial entry method, period of access before detection, encryption scope, complete affected population, ransom demand or payment and final technical recovery date remain unresolved.

Threat actor and claim

Listed as: Florida Memorial UniversitySource: ransomware.liveDiscovered:

Claim details

INC Ransom’s listing names Florida Memorial University and uses fmu.edu. Comparitech reported the claim and alleged passport, Social Security and contract samples March 28, 2024. The tracker recorded discovery that day; the original claim publication date is unknown. The university currently uses fmu.edu and fmuniv.edu. Neither current domain usage nor its later notification independently confirms INC Ransom’s responsibility or every alleged stolen document.

Organizations involved

Impacted locations

  • Miami Gardens, Florida

    Miami Gardens hosts the university’s campus at 15800 NW 42nd Avenue. The network shutdown establishes a university-system interruption without identifying effects at each campus building.

  • Miami-Dade County, Florida

    Miami-Dade County contains Florida Memorial University’s campus at 15800 NW 42nd Avenue in Miami Gardens. The university disconnected its network after detecting unauthorized access; this relationship identifies the campus’s physical county location rather than a countywide outage or an attack on county government.

Sources

Ransomware group claims it breached Florida Memorial University, stole SSNs

Comparitech reported INC Ransom’s claim and alleged posted scans of passports, Social Security information and contracts. The university had not confirmed or denied the allegation, and the report did not establish operational effects.

Florida Memorial University Notice of Data Breach

The university detected unauthorized access March 9, 2024, and immediately disconnected its network. Its June 27 review found that names, birth dates and Social Security numbers may have been acquired. No misuse had been reported by the July 29 notice.

Florida Memorial University — INC Ransom listing

The tracker records an INC Ransom listing naming Florida Memorial University and using fmu.edu. The listing does not independently establish the attacker or complete data scope.

See something that needs correction?

Signed-in members can report an error, update, or missing source.