Iran's MOIS-linked Ravin Academy hit by data breach

"In a statement posted to its Telegram channel on October 22, Ravin confirmed that the attack targeted one of the online platforms it hosts, and highlighted the timing as an attempt to undermine confidence in Iranian security. "As a result of this attack, some of the public information of participants (including username and phone number) on this platform has not been recorded," the statement read, according to a machine translation from Persian that likely meant the data had been recorded."

""This incident, coupled with the repeated publication of false and misleading content in the past, has the goals of damaging the reputation of this academy, undermining security in Iran, and harming the standing of the National Olympiad in the field of cybersecurity. "Given the media efforts over the past year to achieve the aforementioned goals, it is natural that the opponents and international competitors of this event seek to damage this great national achievement.""

"Ravin was sanctioned by the UK, US, and EU between 2022 and 2023 for its role in recruiting cyber specialists to carry out human rights violations. It acknowledged that details such as names, phone numbers, and usernames of some academy associates were compromised by whoever was behind the attack. However, UK-based Iranian activist Nariman Gharib claimed to have been sent a copy of the data that was stolen from Ravin Academy, and has made it publicly available via a dedicated website."

Ravin Academy was established in 2019 to train individuals in cybersecurity and recruit specialists for Iranian intelligence (MOIS) projects. The academy was sanctioned by the UK, US, and EU between 2022 and 2023 for recruiting cyber specialists to carry out human rights violations. On October 22, Ravin confirmed an attack on one of its online platforms that compromised public participant information, including usernames and phone numbers, and acknowledged that some associates' names and contact details were exposed. The academy framed the breach as an effort to damage its reputation and national cybersecurity initiatives. A UK-based activist published a copy of the stolen data online.

Read at Theregister