Qilin ransomware: University of Texas at Arlington — personal data of students/employees stolen in breach
Severity: medium · Patch status: no-fix-needed · Since 2026-11-13
The University of Texas at Arlington warned students and employees that personal information was stolen by hackers who breached its systems during a cybersecurity incident in October 2026. The Qilin ransomware gang claimed the attack; the university confirmed stolen data but declined to specify what was taken, and is still identifying affected individuals. The MachForms portal used for event registration, service requests and surveys was taken down and remains offline. Qilin is among the most active ransomware groups (344 claimed attacks July–September 2026 per Halcyon), recently claimed an ATF attack, and one of its leaders was identified as Russian national Aleksey Mikhailovich Yakovtsev. Other universities (York, Vanderbilt, Michigan State, New Mexico) are also dealing with ransomware fallout.
What to do
- Monitor university notifications and enroll in identity/credit protection if offered once affected individuals are contacted
- Assume compromised data may be used for phishing and targeted fraud; verify requests claiming to come from the university
- Review access to MachForms and university systems; rotate credentials and enable MFA
- Watch for follow-on extortion or leaked data on Qilin leak sites
Sources
All live incidents on Threat Watch
