Universidad de Investigación y Desarrollo · Breach

Actor claims breach of Colombian university UDI, offers databases for sale

Nov 03, 2026 · 1 min read

Actor Nemesh1t, linked to the Atr0phyx 404 crew, claims to have breached Universidad de Investigación y Desarrollo (UDI) in Colombia and posted samples from two databases with over 2,000 records each. The full databases are offered for sale and the actor claims the underlying vulnerability remains active; the breach is unverified. UDI should confirm the data's authenticity and investigate system access.

By HIFY Radar newsroom Updated 11/03/2026 04:07 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An actor known as Nemesh1t, linked to the Atr0phyx 404 crew, claims to have compromised systems at Universidad de Investigación y Desarrollo (UDI), a university in Colombia. The actor published samples from two databases with over 2,000 records each and is offering the full databases for sale. The claim is unverified.

Why it matters

The exposed data reportedly includes names, national identification numbers, university email addresses and academic status of students and faculty. National ID numbers enable fraud and targeted attacks against the academic community. The actor claims the flaw used in the intrusion remains active, suggesting risk of further leaks.

What to do

Investigate anomalous access to the databases, confirm whether the samples contain real institutional data and identify the source system. If exposure is confirmed, activate the incident response plan and notify affected people and the relevant authorities in Colombia.

For the technical team

Affected: Universidad de Investigación y Desarrollo (UDI) Sistemas da Universidad de Investigación y Desarrollo (UDI), universidade da Colômbia; amostras de duas bases com mais d · Systems and databases of Universidad de Investigación y Desarrollo (UDI), a university in Colombia.
Exploitation: Claim by actor Nemesh1t, linked to the Atr0phyx 404 crew, reported by DarkWebInformer. Unverified.
Fix: No software to update
More details: The actor is offering both full databases for sale and claims the vulnerability used in the intrusion remains active. Samples include names, national identification numbers, university email addresses, academic status, courses, student groups and subject details of students and faculty. Each database reportedly holds over 2,000 records.