The University of Illinois Chicago says affected systems have been restored and patient care at its health system was unaffected.

 

What happened

The University of Illinois Chicago discovered a ransomware attack that limited access to some systems at its College of Medicine, with attackers stealing information held on the college's servers, The Record reported. A university spokesperson said an investigation is underway to establish whether personal, research, or academic information was compromised. All affected systems have been restored, the main university network was not involved, and there was no effect on patient care at UI Health. The incident was reported to law enforcement, and the university says it will notify anyone whose information was taken. A group calling itself Booba claimed the attack last week and says it took 344 gigabytes of data.

 

Going deeper

A college of medicine holds categories of information outside a hospital's clinical systems. Student records, admissions files, and academic data account for part of it, with the college teaching around 1,300 students within a university serving more than 35,000 across 16 colleges. Research data accounts for the rest, and in a medical school that can include study records, grant documentation, and correspondence between faculty who also practice clinically. The university has not said which of those categories was reached, and its statement separates the question of personal information from research and academic information without indicating which is involved.

 

In the know

Booba first appeared at the end of July 2026 and has claimed 49 attacks since. Researchers examining the group assess it as a rebrand of the Frag ransomware operation, based on the design of its leak site and the way it conducts negotiations, according to The Record. Files it encrypts are renamed with a .booba extension, and versions exist for both Windows and Linux systems. Its victims have included companies and small county governments, among them Merrimack County in New Hampshire, where the attack left dispatchers unable to reach criminal records held in state software to pass to officers.

 

The big picture

Research and academia is the most heavily targeted sector within state and local government and education, accounting for 38% of observed attacks between November 2025 and April 2026, according to the Microsoft Digital Defense Report 2026. The same report places research and academia third among all sectors targeted globally at 14%, behind government and information technology, and attributes the interest to high-value information held in environments that are often less closely monitored. Academic medical centers carry both profiles at once, running clinical operations on one side and research and teaching on the other, with faculty frequently working across both. Separating those environments is what kept the hospital running here, and the question it raises for similar institutions is whether a faculty member's research systems and their clinical access are genuinely separate or share credentials.

 

FAQs

Does a medical school breach trigger HIPAA notification?

Only where protected health information was involved, which depends on what the affected systems held. Research data can fall under HIPAA where it contains identifiable health information from clinical sources, while purely academic records generally do not.

 

What makes research data attractive to a ransomware group?

It is difficult to reconstruct, often represents years of work and substantial funding, and may carry commercial or competitive value. Organizations holding it therefore face pressure to pay that does not depend on patient care being disrupted.

 

Why do ransomware groups rebrand?

A new name sheds law enforcement attention, negative publicity from previous victims, and any sanctions attention attached to the old one. Operators and tooling typically carry over, which is how researchers connect the two.

 

What does a claim of 344 gigabytes actually tell you?

Little on its own. Volume says nothing about what the files contain, and groups routinely inflate figures. Confirmed findings come from the organization's own forensic review rather than from the leak site.