Breaches and incidentsBriefChecked against a primary source
Sapienza University of Rome: ransomware encrypts about 400 servers, portals and student platform down
The attack on 1 Feb 2026 began with unauthorized access; about 400 physical and virtual servers were involved and data on compromised systems encrypted.
- Disclosed
What happened
- The attack on 1 Feb 2026 began with unauthorized access; about 400 physical and virtual servers were involved and data on compromised systems encrypted. Institutional portals, the InfoStud student platform and administrative workstations were interrupted for several days (CM Alliance). Possibly affected personal data on the central file-sharing system and staff workstations includes identity, contact, payment, health, criminal-record and identity-document data; Sapienza reports no evidence of theft or publication.
- Root cause: unauthorized access; method not disclosed.
- Attacker: not named by Sapienza (secondary reports link it to BabLock/Rorschach; unconfirmed).
- Response: systems restored progressively from verified backups with Italy’s ACN, which closed the incident on 2 Apr 2026; Garante notified; precautionary notifications.
Sources
- https://www.uniroma1.it/it/node/538826
- https://www.cm-alliance.com/cybersecurity-blog/february-2026-recent-cyber-attacks-data-breaches-ransomware-attacks
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.