Florida Memorial University shut off network access after detecting unauthorized activity on March 9, 2024. The private university in Miami Gardens, Florida, later notified individuals that personal information might have been acquired. The interruption is documented, while its duration and the full extent of data compromise remain uncertain.
Analyst assessment
The university’s July 29 notification confirms unauthorized access and immediate network isolation, followed by a specialist forensic investigation. Its electronic review concluded June 27 and identified possible acquisition of recipients’ names, birth dates and Social Security numbers. The letter describes a potential acquisition finding rather than a definitive accounting of everything removed.
Comparitech’s March 28 report establishes public cyber-specific reporting before the July notice: INC Ransom claimed the university and posted alleged document samples. That dated report supports the early public-evidence chronology independently of when a tracker discovered the listing. The university’s notice does not identify INC Ransom or confirm encryption.
Operational significance
Shutting off all network access established an availability interruption and a containment response. The public record does not identify each affected application, canceled class or closed campus facility. June’s document-review completion and July’s notification are later investigative and disclosure milestones, rather than evidence that the network remained offline for those months. No precise restoration date is established.
Confidence and uncertainty
Confidence is high in unauthorized access and isolation because the university directly acknowledged both. Confidence is lower in the claimed data scope and named-actor responsibility. Comparitech reported scans of passports, Social Security information and contracts posted as alleged evidence; that report does not independently authenticate every document or identify all affected people. The university said it had received no reports of misuse as of its notice, which does not negate the underlying exposure risk.
The INC Ransom tracker entry names the institution and uses fmu.edu, a domain now used by its official website. The listing remains an allegation, and current domain ownership does not establish every historical technical detail.
Analytic gaps
The initial entry method, period of access before detection, encryption scope, complete affected population, ransom demand or payment and final technical recovery date remain unresolved.