Ransomware Gang Booba Steals 344 GB from University of Illinois Chicago College of Medicine

What happened

Booba ransomware encrypted files on the College of Medicine’s servers and stole roughly 344 GB of data, causing temporary loss of access to several college systems. The university restored the affected systems, reported the incident to law enforcement, and began notifying potentially impacted individuals.

Why it matters for trust and compliance

• The event underscores the importance of a continuously monitored incident‑response program that can produce defensible evidence for auditors and regulators.
• Provides a concrete example of why continuous control monitoring and evidence collection are vital for audit readiness.
• Demonstrates how mapping ransomware response to control objectives supports multi‑framework compliance.

Who is affected

Recommended actions

1. Validate and test ransomware‑specific incident‑response playbooks.
2. Preserve logs, backups, and forensic data to build an audit‑ready evidence trail.
3. Ensure backups are frequent, immutable, and regularly restored in tests.
4. Map post‑incident findings to the relevant control objectives in your compliance framework.