{"id":"sapienza-university-ransomware-student-services-feb-2026","category":"breach","status":"closed","title":"Sapienza University of Rome ransomware attack knocks out student services; systems restored, no theft found","tldr":"A ransomware attack in early February 2026 encrypted about 400 servers at Rome's Sapienza University (112,500+ students). Systems are restored from backups and the incident is closed. The university found no evidence of data theft. Watch for suspicious emails or calls.","summary":"Sapienza University of Rome, with more than 112,500 enrolled students, shut down its network after a cyberattack in early February 2026. Students could not book exams or check tuition payments for days. Italian media reported ransomware linked to the BabLock (Rorschach) strain and a pro-Russian group called Femwar02, but the university did not name the group in the reports we read. Its later official notice confirms ransomware encrypted data on about 400 physical and virtual servers, central administration file shares and staff workstations. The university restored systems from backups after checking their integrity and added security measures. Italy's cybersecurity agency (ACN) closed the incident on 2 April 2026. The university reported the breach to the Italian data protection authority and notified affected people. The categories possibly affected include identity, contact, payment, identification document, criminal record and health data. It says it has found no evidence the data was stolen, leaked or used for fraud. Sources differ on the start date: the notice says 1 February, press reports say 2 February.","action":"If you are a Sapienza student or staff member, be wary of unexpected emails, calls or messages asking for personal or payment details. You can contact the university's data protection officer to exercise your privacy rights.","product":"Sapienza University of Rome (student portal, InfoStud and administrative systems)","audience":"both","severity":"high","patch":"na","exploited":false,"cves":[],"tags":["ransomware","university","italy","sapienza","education","data-breach","bablock","outage"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Sapienza University of Rome data breach notice","url":"https://www.uniroma1.it/en/node/538826","by":"Sapienza University of Rome","date":"2026-04-09"},{"kind":"news","title":"Italian university La Sapienza goes offline after cyberattack","url":"https://www.bleepingcomputer.com/news/security/italian-university-la-sapienza-goes-offline-after-cyberattack/","by":"BleepingComputer","date":"2026-02-05"},{"kind":"news","title":"Italian university La Sapienza still offline to mitigate recent cyber attack","url":"https://securityaffairs.com/187702/cyber-crime/italian-university-la-sapienza-still-offline-to-mitigate-recent-cyber-attack.html","by":"Security Affairs","date":"2026-02-07"},{"kind":"news","title":"L'esteso attacco informatico contro la Sapienza di Roma","url":"https://www.ilpost.it/2026/02/07/attacco-informatico-sapienza-roma/","by":"Il Post","date":"2026-02-07"},{"kind":"news","title":"Italy's La Sapienza University Goes Offline Following Cyberattack","url":"https://www.thaicert.or.th/en/2026/02/09/italys-la-sapienza-university-goes-offline-following-cyberattack/","by":"ThaiCERT","date":"2026-02-09"}],"started":"2026-02-02","closed":"2026-04-09","created":"2026-11-03T21:40:34.763Z","updated":"2026-11-03T21:40:34.763Z","cve_notes":[],"timeline":[{"at":"2026-04-09","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"The university's notice says the ransomware hit about 400 servers and encrypted data. It lists identity, contact, payment and health data among the categories possibly affected, and reports no evidence of theft or leaks. The breach was reported to the Italian data protection authority and data subjects were notified.","url":"https://www.uniroma1.it/en/node/538826","by":"Sapienza University of Rome","patch":"na"},{"at":"2026-04-02","added":"2026-11-03T21:37:06.107Z","kind":"all-clear","text":"Italy's National Cybersecurity Agency (ACN) closed the incident. The university says it restored systems from checked backups and added security measures.","url":"https://www.uniroma1.it/en/node/538826","by":"Sapienza University of Rome","patch":"na"},{"at":"2026-02-06","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"The university announced a partial restoration of the portal login. Il Post reported on 7 February that exam booking and tuition lookups were still down and that restoring from backups was complex, with no date for full service.","url":"https://www.ilpost.it/2026/02/07/attacco-informatico-sapienza-roma/","by":"Il Post","patch":null},{"at":"2026-02-04","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"Italian media, citing the malware's traits, reported a ransomware attack linked to the BabLock (Rorschach) strain and a pro-Russian group called Femwar02. The university had not confirmed the attack type or the group.","url":"https://securityaffairs.com/187702/cyber-crime/italian-university-la-sapienza-still-offline-to-mitigate-recent-cyber-attack.html","by":"Security Affairs","patch":null},{"at":"2026-02-02","added":"2026-11-03T21:37:06.107Z","kind":"disclosed","text":"Sapienza University of Rome took its network systems offline after a cyberattack. Its website went down and students could not book exams or check tuition payments.","url":"https://www.bleepingcomputer.com/news/security/italian-university-la-sapienza-goes-offline-after-cyberattack/","by":"BleepingComputer","patch":"na"}],"url":"https://hard.fyi/live/sapienza-university-ransomware-student-services-feb-2026/","json":"https://hard.fyi/api/live?id=sapienza-university-ransomware-student-services-feb-2026"}