Qilin Ransomware Steals Data From UT Arlington
The University of Texas at Arlington confirmed that hackers stole personal information about students and employees in last month's attack. The Qilin ransomware gang, one of today's most active groups, claimed it.
⚡ Why it matters
Universities hold large amounts of personal data and are a repeat ransomware target. Students and staff should expect phishing that follows breaches like this.
The University of Texas at Arlington (UTA), which serves more than 41,000 students, told students and staff that its investigation confirmed personal data was stolen during last month's incident. The university has not said what data was taken and will contact affected people directly once they are identified.
When the attack was first disclosed, UTA took MachForms offline. The portal handles event registration, service requests and surveys, and it remains down.
Who is behind it
The Qilin ransomware gang claimed the attack this week. Halcyon data credits the group with 344 claimed attacks from July to September 2026, the second most of any gang, and it recently claimed an attack on the US ATF. Researchers this week named Russian national Aleksey Mikhailovich Yakovtsev as one of its leaders.
A wave hitting universities
UTA is not alone. Canada's York University confirmed theft of student records going back more than a decade, and Vanderbilt University said full recovery could take weeks.
If you are affected
- Ignore messages that ask you to update details or reset passwords because of the incident.
- Change your university password and turn on two-factor authentication.
- Watch your bank accounts for unusual activity.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.