Clop Ransomware group claims the hack of Harvard University

The Clop Ransomware group claims to have hacked Harvard University, adding the institution to its Tor data leak site and warning that stolen data will be leaked soon. The article notes that Clop operates as a ransomware-as-a-service gang and is described as a prolific, Russian-speaking threat, specialising in big‑game hunting and double extortion.

It traces Clop’s appearance to early 2019, linking the group to TA505 and highlighting its use of data-leak sites to pressure victims into paying after stealing data and encrypting networks. Harvard is presented among Clop’s listed victims as the group’s leak page went live, with tags and social posts amplifying the claim, including a message about page creation and forthcoming torrent links.

The piece also recounts Clop’s major campaigns, such as MOVEit Transfer (2023) and GoAnywhere MFT (2023), alongside other incidents like Accellion FTA (2020–2021). It notes the group’s history of exploiting zero-days and vulnerable third‑party software to maximise impact and monetisation, and lists other known victims including Shell, British Airways, Bombardier, the University of Colorado, PwC and the BBC. The article is authored by Pierluigi Paganini and dated 12 October 2025.