Alleged sale of over 656K Hong Kong Metropolitan University records
A threat actor on a dark web forum claims full access to Hong Kong Metropolitan University's (HKMU) main database and is offering more than 656,000 records for $1,500, with a sample posted. The claimed data includes names, emails, phone numbers, HKID and passport numbers, dates of birth, bank account details, academic grades and employment history. HKMU has not confirmed an incident; anyone linked to the university should watch financial accounts and beware of phishing in HKMU's name.
What happened
A threat actor on an underground forum is offering a database of more than 656,000 records attributed to Hong Kong Metropolitan University (HKMU) for $1,500. The actor claims the data includes names, emails, phone numbers, HKID and passport numbers, dates of birth, bank details, academic grades and employment history. The university has not confirmed an incident.
Why it matters
If genuine, HKID and passport numbers combined with birth dates and bank details carry a high risk of identity theft and financial fraud for students, alumni and staff. The data would also make phishing that poses as the university far more convincing.
What to do
Treat it as an unverified claim and watch for official HKMU statements. Advise anyone with ties to the university to monitor bank accounts and distrust messages citing these details. Check for any institutional or data relationship with HKMU.
For the technical team
- Affected
- Hong Kong Metropolitan University (HKMU); base alegada de mais de 656 mil registros com dados pessoais, números de ident · Hong Kong Metropolitan University (HKMU): claimed database of more than 656,000 personal records, per the seller.
- Exploitation
- Sale announced on a dark web forum with a posted sample and a $1,500 asking price, reported by DailyDarkWeb. No confirmation from HKMU; no CVE or specific vulnerability involved.
- Fix
- Not applicable: alleged data leak, no software fix.
- Vector
- Alleged full access to the university's main database, per the threat actor; the method used to obtain access was not disclosed.
- More details
- The claim comes from the threat actor: full access to the main database, a posted sample, and a $1,500 price for the full dataset. Claimed fields: names, email addresses, phone numbers, HKID and passport numbers, dates of birth, bank account details, academic grades and employment history. DailyDarkWeb classifies it as an unverified threat-actor claim.
Timeline
Actor announces the database for sale on a dark web forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
