CUNY Research Foundation Hit by Booba Project (Oct 2026)

Claim Summary

The Research Foundation of The City University of New York (RFCUNY) has been listed on a ransomware leak site operated by a group calling itself “Booba Project.” According to the threat actor, the organization was allegedly breached on October 20, 2026, with the group claiming to have exfiltrated approximately 295 GB of data. The listing categorizes the victim under “Education Administration Programs” and identifies the organization as a US-based education entity.

These claims remain entirely unverified. No confirmation has been issued by RFCUNY, and no independent security firm has validated the alleged breach or the purported data volume. The information below reflects only what the threat actor has publicly asserted.

Threat Actor Profile

Booba Project is a relatively obscure ransomware operation with little to no established public track record. At the time of this report, the group’s total known victim count is unknown, and there are no publicly documented research references, malware analyses, or threat intelligence reports attributing specific tools or tactics to this actor.

Because the group’s known tools are listed as unknown, we cannot assess its technical sophistication, its typical dwell time, or its preferred initial access vectors. Groups that emerge without documented tooling or prior confirmed victims should be treated with heightened skepticism - some are legitimate operations building notoriety, while others are opportunistic or even fraudulent “brands” that repost or fabricate claims to attract attention. No YARA rules or detection signatures specific to this group are currently available in public sources.

Alleged Data Exposure

The threat actor claims to have stolen 295 GB of data, purportedly relating to education administration programs. Beyond the stated volume and category, no further detail has been provided publicly, and we have not reviewed, accessed, or reproduced any data samples. It is common for ransomware groups to inflate claimed data volumes to increase pressure on victims and to lend an appearance of severity. The 295 GB figure should be regarded as an unsubstantiated assertion until corroborated.

Potential Impact

If the claim is accurate, a breach of this scale at an education research foundation could implicate administrative records, grant and funding documentation, and internal communications. Education institutions and their affiliated foundations are attractive targets because they hold sensitive research data and often operate with constrained security budgets. However, given the group’s lack of a verifiable track record, the practical risk cannot be reliably estimated at this time. Organizations with vendor or research relationships to RFCUNY should monitor for official statements rather than acting on leak site claims alone.

What to Watch For

• Official statements from RFCUNY or CUNY confirming, denying, or investigating the claim.
• Regulatory or law enforcement notifications that would corroborate a breach.
• Any authenticated data samples published by the group - treat these as unverified until independently analyzed.
• Whether Booba Project publishes follow-up content or escalates its claims, which may indicate credibility or the opposite.
• Related activity targeting other education sector entities that could reveal the group’s tactics.

Disclaimer

This report is based solely on an unverified claim published on a ransomware group’s leak site. Nothing herein has been independently confirmed. Yazoul Security has not validated the alleged breach, the data volume, or the authenticity of any data. Ransomware operators frequently exaggerate or fabricate claims to pressure victims. Readers should rely on official statements from the affected organization and authorized investigators. For related threat intelligence, see our intel hub.