Université Libre de Bruxelles Data Breach

Université Libre de Bruxelles, an education organization based in Belgium, has been listed as a victim on the qilin ransomware group’s dark web portal, published on August 9, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Based on the sector and country data captured for the listing, the organization operates in the education space in Belgium. It joins a run of recent qilin listings that CTI teams have been tracking across the group’s leak portal. In the 60 days prior to this listing, qilin has claimed 146 other victims across its leak portal. The group has shown a strong targeting pattern in the Manufacturing, Business Services and Professional Services sectors. Geographically, its victims cluster in the United States, Germany and France. Other recent qilin listings that overlap with Université Libre de Bruxelles’s profile include Universitatea De Vest Vasile Goldi Din Arad, Salida Union School District, The Nueva School, and Orimar. Université Libre de Bruxelles fits the broader pattern of mid-market organizations appearing on this portal rather than standing out as an outlier.

Initial-access correlation against SOCRadar’s stealer-log telemetry surfaced a severe exposure for the ulb.be domain. The queried slice returned two confirmed employee credentials (category A) tied to the university’s own authentication infrastructure at auth.ulb.be, alongside a further corporate credential surfaced against a third-party SaaS platform (category C). The pairing of direct identity-provider access with a workstation-compromise indicator points to a corporate-intrusion profile rather than isolated consumer exposure, and the freshest records in the slice were inserted in early August 2026, close to the listing date. As a matter of policy we do not publish the masked usernames, partial passwords or raw URLs contained in the underlying records; the picture above is paraphrased from SOCRadar’s automated stealer-to-ransom analysis. For ransomware groups such as qilin, infostealer-harvested credentials are a well-documented initial access vector: operators or initial access brokers source fresh logs from underground marketplaces, validate the corporate credentials, and use them to log into Microsoft 365, VPN or remote-access portals before deploying ransomware. While the stealer-log evidence here does not confirm that these specific credentials were used by qilin, the pattern is consistent with the kill chain typically observed for this class of incident, and it makes credential rotation and session-token invalidation the sensible first moves for any responder working this case.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.