MSM Unify Data Breach

kazu ransomware listed MSM Unify on its dark web portal on September 7, 2026, as identified through SOCRadar’s Dark Web Monitoring. MSM Unify is a Canadian ed-tech platform that connects international students with higher-education institutions, managing both institutional partner accounts and large volumes of individual student applicants. This dual role presents significant risk, as a single compromised employee credential can provide access to institutional data, and the exposure of 19 student accounts places applicant personal data at risk. kazu has claimed 10 other victims in the past 60 days, with a focus on the Healthcare, Education, and Professional Services sectors across the United States, Canada, and Mexico. Spirit Cultural Exchange is among the recent education-sector victims listed by the group. MSM Unify’s targeting aligns precisely with kazu’s established pattern, indicating no deviation from the group’s typical victim profile.

SOCRadar’s stealer-log telemetry returned 25 records associated with msmunify[.]com. These records include one employee credential (category A) found on the primary sign-in endpoint, app.msmunify[.]com/signin. Additionally, 19 student/consumer accounts were identified on the same endpoint. The telemetry also revealed 5 corporate third-party records linked to Medha education services, a partner in MSM Unify’s recruitment network. The identified records span from February 2025 to September 7, 2026. The exposed employee credential represents the highest risk and is the most probable initial access vector. The exposure of partner data at Medha further extends the potential impact beyond MSM Unify’s immediate infrastructure. Immediate credential rotation for app.msmunify[.]com and a thorough review of access related to Medha are critical first steps. Given the volume of student accounts involved, MSM Unify may also face notification obligations regarding applicant data, depending on applicable jurisdictions.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.