UTA has confirmed that hackers have stolen personal information as a result of a cyberattack last month that affected its IT environment. A university investigation into unauthorized activity has led to this disclosure, although the university has not yet determined the full extent of the data exposure or identified all individuals whose information may have been compromised as a consequence of the data exposure.
During a response to Recorded Future News, a university spokesperson confirmed the investigation identified data theft, but did not provide specific details regarding which types of information were accessed by the attackers. As part of the university's ongoing efforts to determine the scope and nature of the compromised data and identify potentially affected students and employees, we are currently conducting research.
According to UTA, individuals who are identified as affected will receive notifications describing the incident, the information involved, and the methods available for protecting their personal information. In addition, the university plans to provide support and guidance to individuals whose information has been exposed.
In the initial phase, the incident was noticed following disruptions involving MachForms, an online platform used for registrations, service requests, surveys, and other administrative functions. UTA immediately took the platform offline as a precautionary measure following the discovery of the security incident.
While the investigation continues, MachForms will remain unavailable. The university has also monitored its IT environment to detect any further impacts on its systems or daily operations. There has been no specific timeline provided for the restoration of the affected service. With approximately 41,000 undergraduate and graduate students, The University of Texas at Arlington is one of the most prestigious higher education institutions in Texas.
It is alarming to learn that personal information belonging to academic and administrative members of the university was stolen, raising concerns about the possibility of sensitive data being exposed. A ransomware attack was claimed earlier this week by the Qilin ransomware group. Qilin has established itself as one of the most active ransomware groups targeting a variety of industries.
Halcyon Ransomware Research Center figures indicate that between July and September 2026, the group is believed to be linked to 344 alleged ransomware incidents, placing it among the top ransomware operators at that time. In addition to the recent arrest of one of the ransomware operation's prominent affiliates in Japan and extradition to Germany, Qilin has also been attracting attention as a result of a series of developments involving its affiliates and leadership.
The Russian national Aleksey Mikhailovich Yakovtsev has been identified as a leader of the ransomware network by cybersecurity companies and independent researchers, adding to ongoing investigations into the individuals behind the ransomware network. In addition to claiming responsibility for attacks on the US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), the group has also claimed responsibility for attacks on government and institutional targets in the past few months.
Using its double-extortion strategy, the organization threatens to publish the stolen files if victims refuse to pay ransom. These tactics increase the workload on organizations, particularly those that handle large volumes of personal and administrative information. This incident occurs during a period when higher education institutions are experiencing a series of ransomware attacks.
According to York University's recent announcement, attackers have accessed and taken substantial amounts of student information, including more than a decade of student records. Besides raising concerns about the long-term exposure of personal information maintained by academic institutions, Vanderbilt University has also suffered from a separate ransomware attack which has adversely affected its operations.
University officials have advised that it may take several weeks to restore normal operation across the university's systems. The university's efforts to recover are concentrating on essential services such as payroll, payment processing, admissions, course registration, and public safety. Vanderbilt remains under investigation for possible data theft.
A group responsible for BYOD ransomware has claimed responsibility for the incident at Vanderbilt, as well as recent attacks that affected Michigan State University and New Mexico University.
Newly emerging groups and their operations are relatively unknown to researchers. There has been an increasing number of attacks against universities, which have highlighted the risk faced by educational institutions that maintain extensive student, employee, and administrative databases.
Having disruptions to academic services, combined with unauthorized access to personal data, can adversely affect institutions and their communities for a long period of time.
Immediately, the top priority at UTA is determining the scope of the breach, identifying those affected, and restoring the impacted services in a secure manner.
As higher education institutions manage large quantities of sensitive student and employee data, cybersecurity risks are becoming increasingly important.
As UTA continues to assess the extent of the breach and identify affected individuals, this case illustrates the importance of strengthened data protection measures, timely incident response, and continuous monitoring of university information technology systems.
As well as reflecting the persistent threat that ransomware groups pose to educational institutions, Qilin's involvement also demonstrates the possibility of long-term consequences when disrupting operations and revealing data.
.jpg "Hackers Steal Personal Information in Cyberattack on University of Texas at Arlington")
.jpg)
