SafePay claims data theft at Mexico's university UAA
The SafePay ransomware group listed Mexico's Universidad Autónoma de Aguascalientes (UAA), a public university, on its leak site on Oct 26, 2026, claiming data theft without details. The claim is unconfirmed; on Oct 14, local media reported intrusion attempts on UAA servers and the university said no data was extracted. If the claim holds, students and staff should expect university-themed phishing.
What happened
The SafePay ransomware group listed the Universidad Autónoma de Aguascalientes (UAA), a public university in Mexico, on its leak site on Oct 26, 2026. The group claims data theft without detailing volume or type. The university has not confirmed the claim.
Why it matters
If the claim holds, student, staff and applicant records could be exposed. Intrusion attempts on Oct 14 had already disrupted institutional email, the E-SSIMA student platform and the virtual classroom. Students and staff are exposed to university-themed phishing.
What to do
Wait for official word from UAA and monitor SafePay's leak site. Tell students and staff not to open unexpected attachments or password reset links. Review access to servers and institutional email.
For the technical team
- Affected
- Universidad Autónoma de Aguascalientes (UAA), universidade pública em Aguascalientes, México · Universidad Autónoma de Aguascalientes (UAA), public university in Aguascalientes, Mexico. Services cited: institutional email, E-SSIMA student platform, virtual classroom.
- Exploitation
- Claim by the SafePay group listed on its leak site on Oct 26, 2026 (UTC), reported by DailyDarkWeb. Unverified claim, no victim confirmation and no details on volume or type of data.
- Fix
- No fix cited in the sources; alleged breach incident with no associated product flaw.
- Vector
- Initial method not described in the sources. On Oct 14, 2026, local media reported intrusion attempts on UAA servers that disrupted institutional email, the E-SSIMA student platform and the virtual classroom. The university said no data had been extracted in that event. Any link to the SafePay claim is unconfirmed.
- More details
- The listing appeared on Oct 26, 2026 (UTC) on SafePay's leak site. On Oct 14, 2026, local media reported UAA detected intrusion attempts. The group shared no proof. Universities hold student, staff and applicant records; expect targeted phishing if the claim holds.
Timeline
SafePay listed UAA on its leak site on Oct 26.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
