The Australian National University (ANU) has launched an investigation into claims of a ransomware attack after being listed as a victim on the darknet leak site of the hacking group FSociety. The university is working closely with the Australian Cyber Security Centre to assess the situation.
FSociety, which typically obscures the full names of its targets, made an exception in this case, making it relatively easy to identify ANU as the alleged victim. In a post dated February 16, FSociety addressed the university’s board, claiming responsibility for compromising its servers and exfiltrating data before encryption. The group threatened to release the stolen information within seven days unless the university complied with unspecified demands.
“To the board of A**n Nl U***y,” the post read. “We have took over the servers Au.edu.au and before encryption we extracted all data, we will give you (seven) days before any leak. All Student and Teacher Leak in this field will hurt future image, if you comply we will be willing to make this all go away. We will be waiting for your response.”
The ransom amount remains undisclosed, and FSociety has not revealed the volume or nature of the data allegedly obtained. ANU has yet to confirm whether its systems were indeed compromised, with a spokesperson stating, “We are investigating and are working with the Australian Cyber Security Centre. We have no further updates at this stage.”
FSociety, in its current form, has been active since May 2024, though a hacking group with the same name first emerged in 2016, known for developing a new ransomware variant. Both iterations of FSociety share the same logo as the fictional hacking collective from the television series Mr. Robot. The group operates as a ransomware-as-a-service provider, allowing affiliates to utilize its platform for cyber extortion. In January 2025, FSociety reportedly partnered with another hacking group, FunkSec, further expanding its capabilities.
ANU is the first Australian institution to be named on FSociety’s leak site, which currently lists a limited number of victims. The Canberra-based university, one of the country’s most prestigious academic institutions, had a total enrollment of 18,934 students in 2022 and employs over 4,000 staff. This is not the first time ANU has faced a cybersecurity incident; in 2019, the university suffered a data breach that exposed 19 years’ worth of personal data from students and staff. Intelligence officials at the time suspected Chinese state actors were behind the attack.
