The University of Illinois Chicago has confirmed that a ransomware attack hit parts of its College of Medicine network and that the attackers obtained some data stored on the college's servers. A ransomware group calling itself Booba has claimed responsibility and says it took 344 GB of data. UIC has not confirmed that figure or said what the stolen data contains.

UIC disclosed the incident in an official notice dated October 2, 2026, and updated the page on October 14. The university has not said when the attack happened. According to the notice, the main UIC network was not affected, and patient care at UI Health, the university's clinical enterprise, was not affected either.

What happened

According to the notice, UIC and College of Medicine IT staff found unauthorized activity in parts of the College of Medicine network. The university then started its incident response protocols and brought in outside cybersecurity experts. The attack left some College of Medicine systems temporarily unavailable, and the university says all affected systems have since been restored.

The notice was signed by Dr. Enrico Benedetti, Interim G. Stephen Irwin Executive Dean of the College of Medicine; Chief Information Officer Matt Riley; and Chief Information Security and Privacy Officer Shefali Mookencherry. It says the university has added security controls and reported the attack to law enforcement.

A UIC spokesperson told The Record on October 5 that the attackers had stolen some information from the college's servers. The university's notice now says the same: "the unauthorized actors obtained some data located on College of Medicine servers."

Who may be affected

UIC says the forensic investigation is still under way. Experts are working out whether the stolen data includes personal, research or academic information, and the university says it will notify affected individuals once that review is complete.

Daily Security Review noted on October 7 that UIC has not said what kinds of records were on the affected servers, how many people may be affected, or when the forensic review will finish.

For scale, The Record reports that UIC is Chicago's largest university, with more than 35,000 students across 16 colleges. About 1,300 of those students are in the College of Medicine. The university has not said whether the affected data concerns students, faculty, staff, research participants or some combination.

What is claimed versus confirmed

UIC has confirmed three things: a ransomware attack, a temporary outage of some College of Medicine systems, and the theft of some data from the college's servers. The amount of data comes only from the attackers. Booba listed UIC as a victim and said it had taken 344 GB. Daily Security Review notes that neither the size nor the contents of the stolen data has been verified.

According to The Record, Booba appeared at the end of July 2026, and SOCRadar counts 49 attacks claimed by the group. Its claimed victims include several companies and small county governments, among them Merrimack County, New Hampshire. The county confirmed a cyberattack several weeks earlier and says it has since recovered. The Record reports that Booba's encryptor adds a .booba extension to the files it encrypts and that the group appears to have variants for both Windows and Linux.

Brett Williams of SentinelOne told The Record that Booba appears to be a rebrand of Frag, an earlier ransomware operation. He based that view on the style of Booba's leak site and the way it handles negotiations. Daily Security Review describes the link as likely but not confirmed.

What It Means for Defenders

  • Alert on mass renames on every platform. Set file-integrity and EDR rules to flag bulk renames to a .booba extension on Linux servers as well as on Windows endpoints.
  • Test segmentation between departmental, central and clinical networks. Make sure a compromise in one college's environment cannot reach central identity, clinical systems or shared file stores, and test that separation instead of assuming it holds.
  • Plan for theft as well as encryption. Monitor research and departmental file servers for large outbound transfers. Keep backups offline or immutable so that recovery does not depend on the attacker.
  • For UIC College of Medicine affiliates: wait for an official notification from the university. Be wary of unsolicited messages that mention the incident, and send questions to [email protected] instead of replying to unexpected contacts.

Sources