University of Illinois Chicago Data Breach

The University of Illinois Chicago (UIC), a major institution operating in the education and healthcare sectors within the United States, has been listed by the Booba Project ransomware group. This listing occurred on October 2, 2026. SOCRadar’s Cyber Threat Intelligence (CTI) has identified significant stealer-log exposures that have been active since June 2024, encompassing over two years of compromised credentials. These exposures include critical authentication services such as UIC’s ADFS/SAML federation service and the Bluestem authentication portal, alongside Google accounts operating under the uic.edu domain and credentials for the MathWorks/MATLAB academic platform. The nature of these platforms, particularly identity federation services, makes UIC a potentially attractive target for ransomware actors seeking broad access to sensitive student, faculty, and research data. The Booba Project ransomware group’s activity underscores the ongoing threat to higher education institutions. While this specific listing provides details about UIC’s credentials, broader threat actor trends indicate a persistent focus on the education sector. These groups often target entities that hold vast amounts of sensitive personal and research data, which can be leveraged for financial gain or disruption. The prolonged exposure window suggests a sophisticated and sustained compromise, highlighting the need for continuous monitoring and robust security measures to detect and mitigate such threats.

SOCRadar’s stealer-log intelligence service detected 16 credential records associated with the University of Illinois Chicago. Five of these records correspond to UIC employee accounts, though details have been partially masked in compliance with responsible disclosure practices. The remaining 11 records are external user credentials linked to services utilized by UIC. The identified platforms include UIC’s ADFS/SAML federation service (sts.uic[.]edu/adfs), the Bluestem authentication portal (login.uic[.]edu/bluestem), Google accounts with the uic.edu domain, and access credentials for the MathWorks/MATLAB academic platform. The exposure of ADFS and Bluestem, which serve as Single Sign-On (SSO) entry points, is particularly concerning as compromising these systems can grant extensive access to various academic resources through a single set of credentials, potentially facilitating lateral movement within the network. A stealer-log record dated October 1, 2026, indicates that credential harvesting activities were ongoing just one day prior to the Booba Project listing the University of Illinois Chicago on their leak site. This discovery extends the confirmed exposure window from June 2024 through October 2026, spanning a period of over two years. The prolonged nature of this credential harvesting raises concerns about the potential depth of the compromise and the types of data that may have been exfiltrated. The continuous activity suggests that the threat actors were actively maintaining access or were in the process of exploiting compromised information. The University of Illinois Chicago holds a wealth of sensitive data, including student records, financial aid information, and healthcare data through its affiliated medical programs. Additionally, faculty research intellectual property is likely stored and accessible. The two-year exposure of credentials across identity federation and academic research platforms provides a substantial foundation for data exfiltration. Particular attention should be paid to the MathWorks exposure, especially if federally funded research data was accessible via MATLAB. Agencies like the NSF and NIH have specific reporting obligations for incidents involving sponsor-funded data. The October 1 record confirms the campaign was active leading up to the leak site listing. Immediate Response: Audit ADFS and Bluestem authentication logs from June 2024 forward. Force-rotate credentials for all 16 identified accounts. Assess MathWorks access logs for research data exposure and notify federal research sponsors if funded project data was in scope. Consult Illinois data breach notification statutes for student data disclosure requirements with the Illinois Board of Higher Education.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.