Uniguacu Data Breach

emperador has listed Uniguacu, a Brazilian education institution, on its leak site on August 30, 2026, claiming unauthorized access to its systems and data. At the time of reporting, no independent verification of these claims had been completed. Educational institutions, due to their often extensive datasets and reliance on various digital platforms, can be attractive targets for ransomware and extortion groups. This listing by emperador marks a potential expansion of their targeting into the education sector, alongside their previously observed focus areas. In the past 60 days, emperador has claimed 10 victims, primarily in Brazil, the United States, and South Korea. Their typical targets have been within the Energy and Utilities, Technology, and Government and Defense sectors. The claim against Uniguacu represents a diversification from these core industries, suggesting an evolving modus operandi for the ransomware group. This aligns with broader trends where threat actors expand their scope to exploit new vulnerabilities or target sectors perceived to have less robust cybersecurity defenses.

Infostealer telemetry data indicates a significant exposure for uniguacu[.]com[.]br, with a total of 18 credentials identified across different platforms. This includes two employee credentials found on academic portals, 15 external student records, and one corporate third-party credential. The timestamps associated with these credentials range from January 9, 2024, to August 30, 2026, covering a period of 31 months that extends up to the date of the leak-site listing. The presence of both employee and student data suggests a widespread compromise within the institution’s digital environment. The identified credentials, particularly those on academic portals and student records, highlight the potential for further exploitation. Such information could be used by threat actors for credential stuffing attacks, phishing campaigns, or to gain deeper access into the institution’s network. The broad scope of the exposed data underscores the importance of immediate action to mitigate risks. Affected credentials should be rotated without delay, and a thorough review of authentication logs for the entire exposure period is strongly recommended. This proactive approach is crucial for identifying any unauthorized access or malicious activity that may have occurred using the compromised credentials. Continuous monitoring of dark web stealer-log feeds and vigilant credential hygiene practices are essential for educational institutions to protect against ongoing threats.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.