Rhysida Ransomware Claims Attack on Malaysia's INTI University
The Rhysida gang listed INTI International University & Colleges, one of Malaysia's largest private higher-education groups, on its data-leak site in a listing dated Oct 30, 2026. The listing does not say what data was allegedly taken or how much, no samples have been verified, and INTI has not confirmed an incident. Students and staff should watch for phishing that uses university branding.
What happened
The Rhysida ransomware gang listed INTI International University & Colleges, one of Malaysia's largest private higher-education groups, as a victim on its data-leak site. The listing, dated Oct 30, 2026, does not say what data was allegedly taken or how much. INTI has not confirmed an incident and there is no independent verification.
Why it matters
If confirmed, the attack could expose student and staff records. In past cases, Rhysida auctioned stolen university data, including ID documents, and runs double extortion, according to CISA and FBI warnings cited by the source. Institutional reputation and the trust of students and partners are at stake.
What to do
Treat this as an unverified threat-actor claim. Activate the incident response plan, investigate signs of compromise, and prepare communications for students and staff. Warn the community about phishing that uses INTI branding.
For the technical team
- Affected
- INTI International University & Colleges, um dos maiores grupos de ensino superior privado da Malásia; listagem de 30 de · INTI International University & Colleges, one of Malaysia's largest private higher-education groups (claim).
- Exploitation
- Listing on Rhysida's data-leak site dated Oct 30, 2026, reported by DailyDarkWeb. No verified samples and no details on data or volume. INTI has not publicly confirmed an incident.
- Fix
- Not applicable; no software fix involved.
- Vector
- Entry method not stated for this case. According to CISA and FBI warnings cited by the source, Rhysida uses phishing and Cobalt Strike to breach victims and runs double extortion.
- More details
- Rhysida has a long record of hitting universities and schools and, in past cases, auctioned stolen staff and student records, including ID documents. The source recommends treating this as an unverified threat-actor claim, not confirmation of a breach.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
