Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible University of Illinois Chicago data breach. According to dark web monitoring sources, a hacker group calling itself Booba Project claimed responsibility for a cyberattack on University of Illinois Chicago in a post first observed in October 2026, alleging it had gained access to internal company systems. As of this writing, University of Illinois Chicago has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About University of Illinois Chicago
The University of Illinois Chicago (UIC) is a public research university located in Chicago, Illinois. It is Chicago’s largest university, enrolling nearly 36,000 students across 16 academic colleges and employing over 12,000 people. UIC is part of the University of Illinois System and is a federally designated Minority-Serving Institution and Carnegie R1 research institution. The university includes a major public medical center and one of the largest colleges of medicine in the nation, along with colleges of dentistry, pharmacy, public health, nursing, and other disciplines.
What Happened?
On October 2nd, 2026, the Booba Project ransomware group published a dark-web leak-site post naming the University of Illinois Chicago as a victim and claiming to have stolen 344 GB of data. This allegation was flagged by dark web monitoring services including Ransomware.live and independently noted by RedPacket Security. Importantly, RedPacket Security has warned that listings attributed to Booba Project have included unverified or fabricated victim claims and should be treated as unconfirmed until corroborated. The attacker’s post does not state that UIC systems were encrypted, does not specify what types of data were allegedly taken, and provides no details about how any intrusion occurred or whether a ransom demand was made. No independent corroborating source has confirmed this claim, and UIC has not made any public statement regarding this specific Booba Project allegation.
Booba Project is a financially motivated ransomware group that first emerged in June or July of 2026. It operates using a double-extortion model, combining data exfiltration with encryption. As of late September 2026, the group had claimed between 18 and 36 victims across multiple countries and sectors. UIC has experienced two prior third-party cyber incidents: a 2023 ransomware attack on the National Student Clearinghouse exposed names and dates of birth of a small number of UIC students, and in May 2026 a breach of the Canvas learning management system operated by Instructure — claimed by the ShinyHunters hacking group — disrupted UIC operations, though UIC stated at the time that no other university systems were directly impacted. Neither prior incident involved a direct compromise of UIC’s own systems. If the current Booba Project claim were authentic, it could represent a more direct incident, but this remains entirely unconfirmed.
Key Facts at a Glance
- Company or Organization: University of Illinois Chicago
- Industry: Higher Education
- Location: Chicago, Illinois, United States
- Incident type: Ransomware leak-site allegation (dark-web claim, unverified)
- Claim first observed: October 2nd, 2026
- Prior breach: Yes — 2023 National Student Clearinghouse third-party breach; May 2026 Canvas/ShinyHunters third-party breach
- Litigation status: No litigation connected to this Booba Project claim found as of October 2nd, 2026
- Source: Ransomware.live – UIC claimed by Booba Project; RedPacket Security – Booba Project Ransomware Victim: University of Illinois Chicago; SOCRadar – Booba Project Ransomware Group Profile
What Should You Do?
If you are a UIC student, employee, or anyone else who may have had personal information held by the university, it is prudent to take protective steps now, even while this claim remains unverified. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitoring your financial accounts and credit reports closely. You can obtain free annual credit reports at AnnualCreditReport.com. If you suspect your identity has already been misused, visit IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
