Istituto Borgo Ransomware Claim by Shiba (Nov 2026)

Claim Summary

The Shiba ransomware group has allegedly listed Istituto Comprensivo di Borgo San Giuseppe, a state comprehensive school based in the Oltregesso area of Cuneo, Italy, on its dark web leak site. According to the threat actor, the attack was purportedly carried out on or around November 6, 2026. The group claims to have exfiltrated data from the institution, though the specific volume of allegedly stolen data has not been disclosed.

Istituto Borgo is a public educational institution operating 11 sites across the Cuneo region, including 3 preschools, 6 primary schools, and 2 lower-secondary schools. The school serves the Oltregesso area and the nearby town of Castelletto Stura. The head of school is identified in the group’s post as Lorenzo Busciglio.

This claim remains entirely unverified. No independent confirmation of the breach, the data theft, or the scope of any alleged compromise has been established at the time of writing.

Threat Actor Profile

Shiba is a ransomware group that has been observed listing victims across various sectors and geographies. Public research on the group remains limited, and its total known victim count is not reliably established. The group’s specific tooling and tactics are not well documented in open-source intelligence at this time.

Based on the absence of detailed public research, Shiba’s operational maturity and technical sophistication cannot be confidently assessed. Groups operating with limited public visibility may be newer entrants, rebrands of existing operations, or low-volume actors that deliberately avoid attention. Analysts should treat claims from such groups with heightened skepticism until corroborating evidence emerges.

No YARA rules or specific detection guidance attributable to Shiba are publicly available at this time. Organizations should rely on general ransomware detection practices, including monitoring for unusual data staging, unauthorized access to file shares, and anomalous outbound traffic.

Alleged Data Exposure

According to the threat actor, data was allegedly exfiltrated from Istituto Borgo. The group has not disclosed the volume, format, or nature of the purportedly stolen data. The leak site post references the institution’s identifying details, including its ministerial code (CNIC847004) and organizational structure, which may simply reflect publicly available information rather than proof of internal access.

No data samples, credentials, or download links are referenced in this report. Yazoul Security does not reproduce or distribute leaked material.

Potential Impact

If the claim is accurate, a school environment could expose sensitive records including student and staff personal data, financial records, and internal communications. Educational institutions in Italy are subject to GDPR and national data protection regulations, meaning any confirmed breach could trigger regulatory scrutiny and notification obligations.

Operational disruption is also a possibility if ransomware was deployed, though the group has not explicitly claimed encryption in this case. Schools are frequently targeted due to perceived weaker security postures and the sensitivity of student data.

What to Watch For

• Independent confirmation from the institution or Italian authorities regarding any security incident.
• Whether Shiba publishes purported data samples, which would lend credibility to the claim.
• Any regulatory notifications under GDPR or communications from the Italian data protection authority.
• Reuse of this claim pattern by the group against other public sector or educational targets.

Disclaimer

This report is based solely on an unverified claim published by the Shiba ransomware group on its leak site. Nothing in this article should be treated as confirmed fact. The allegation has not been independently verified by Yazoul Security, the affected organization, or any third party. Ransomware groups frequently exaggerate or fabricate claims to pressure victims into payment. Readers should await official confirmation before drawing conclusions.