Cyberattack Disrupts Operations at Rome’s La Sapienza University
Rome’s La Sapienza University, Europe’s largest by in-campus enrollment with over 112,500 students, fell victim to a cyberattack this week, forcing the shutdown of its IT systems as a precautionary measure. The university confirmed the incident via social media, stating that its infrastructure had been targeted and that authorities were immediately notified.
As of the latest updates, the university’s website remains offline, and recovery efforts are ongoing. Temporary "infopoints" have been established to provide students with access to critical information while digital systems remain unavailable. A technical task force, working alongside Italy’s Agenzia per la Cybersicurezza Nazionale (ACN) and Polizia Postale, is leading remediation efforts, focusing on restoring systems from backups reportedly unaffected by the attack.
Italian newspaper Corriere Della Sera attributed the incident to the Femwar02 threat group, a pro-Russian actor linked to the Bablock/Rorschach ransomware strain. First identified in 2023, Rorschach is known for its rapid encryption and customizable attack methods, drawing from leaked code of Babuk, LockBit 2.0, and DarkSide. While a ransom demand exists, university officials have not accessed it to avoid triggering a 72-hour deadline, leaving the amount unspecified.
Though Rorschach does not operate a dark web extortion portal, the risk of stolen data being leaked or sold remains. The attack has disrupted academic operations, with recovery efforts expected to continue in the coming days.
Università La Sapienza cybersecurity rating report: https://www.rankiteo.com/company/universit-la-sapienza
"id": "UNI1770316408",
"linkid": "universit-la-sapienza",
"type": "Ransomware",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '112,500 students',
'industry': 'Education',
'location': 'Rome, Italy',
'name': 'La Sapienza University',
'size': '112,500 students (in-campus enrollment)',
'type': 'University'}],
'data_breach': {'data_encryption': 'Yes (Rorschach ransomware)',
'data_exfiltration': 'Possible (risk of stolen data being '
'leaked or sold)'},
'description': 'Rome’s La Sapienza University, Europe’s largest by in-campus '
'enrollment with over 112,500 students, fell victim to a '
'cyberattack this week, forcing the shutdown of its IT systems '
'as a precautionary measure. The university confirmed the '
'incident via social media, stating that its infrastructure '
'had been targeted and that authorities were immediately '
'notified. The attack has disrupted academic operations, with '
'recovery efforts expected to continue in the coming days.',
'impact': {'operational_impact': 'Disrupted academic operations',
'systems_affected': 'IT systems, website'},
'investigation_status': 'Ongoing',
'motivation': 'Pro-Russian',
'ransomware': {'data_encryption': 'Yes',
'data_exfiltration': 'Possible',
'ransom_demanded': 'Unspecified (not accessed by university '
'officials)',
'ransomware_strain': 'Bablock/Rorschach'},
'references': [{'source': 'Corriere Della Sera'}],
'response': {'communication_strategy': 'Social media updates',
'containment_measures': 'Shutdown of IT systems, establishment '
'of temporary infopoints',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes',
'recovery_measures': 'Ongoing',
'remediation_measures': 'Restoring systems from backups',
'third_party_assistance': 'Agenzia per la Cybersicurezza '
'Nazionale (ACN), Polizia Postale'},
'threat_actor': 'Femwar02',
'title': 'Cyberattack Disrupts Operations at Rome’s La Sapienza University',
'type': 'Ransomware'}