Iranian Intel-Linked Cybersecurity School Hit by Data Breach

A leaked trove of internal records from a cyber training center linked to Iranian intelligence exposed the personal data of individuals allegedly enrolled in its technical programs.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Ravin Academy, founded in 2019 to serve as a talent pipeline for Iran’s Ministry of Intelligence and Security, was sanctioned by the U.S. Department of Treasury’s Office of Foreign Assets Control in 2022 for “having materially assisted” the nation’s intelligence apparatus. The cybersecurity training firm provides students with courses in defense and offensive cyber tasks, including red-teaming, malware reverse-engineering and vulnerability analysis.

The organization confirmed in an Oct. 22 post to its Telegram channel that a breach had exposed usernames and phone numbers of some participants, stating the incident “has the goals of damaging the reputation of this academy, undermining security in Iran and harming the standing of the National Olympiad in the field of cybersecurity.” The full dataset was provided to U.K.-based activist Nariman Gharib, who published portions of it on his website.

The breach came after a summer of intensified Iranian cyber activity against a backdrop of hostilities with Israel and the U.S., including a rise in ransomware attacks on healthcare and public health organizations (see: Feds Warn Healthcare Sector of Rising Iranian Cyberthreats).

In June, Iran shut down internet access nationwide in response to suspected Israeli cyberattacks, with officials calling the disruptions “temporary, targeted and controlled.”

Students named in the breach come from varied academic and professional backgrounds, including Iranian universities and technical departments abroad, with some reportedly linked to Western institutions. The breach was first reported by The Register.

The database contains records on more than 1,000 individuals, believed to include current and former students who participated in Ravin Academy’s cyber training programs. Gharib says the organization’s co-founders were “specifically directed by MOIS to establish the company for recruitment purposes.” The breach took place “mere days before Ravin Academy’s annual Tech Olympics event.”

“This operational security failure undermines the company’s public credentials while simultaneously exposing individuals who enrolled in what they may have believed were legitimate professional development programs,” Gharib wrote.