[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDQw-_VrBt7pVz7iBfdx5z3UjCg38Uhj5WiTQKvHQm4s":3},{"article":4,"iocs":45,"watch_terms":49,"solutions":50,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"bace110c-c68c-4b3e-beb8-6faa941eb170","University of Texas at Arlington warns personal information stolen during cyberattack","university-of-texas-at-arlington-warns-personal-information-stolen-during-cybera-ff3fa2","In a statement to Recorded Future News, a spokesperson said an investigation into the attack confirmed the stolen data but declined to say what information was obtained by the threat actors.","The University of Texas at Arlington has confirmed that personal information was stolen during a cybersecurity incident last month. An investigation is ongoing to determine the specific data compromised and affected individuals. The Qilin ransomware gang has claimed responsibility for the attack, which also led to the temporary offline status of the MachForms online portal.","University of Texas at Arlington confirms personal information stolen in cyberattack claimed by Qilin ransomware.","https:\u002F\u002Ftherecord.media\u002Funiversity-of-texas-arlington-warns-data-breach","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FUniversity_of_Texas_at_Arlington_March_2021_103_Gateway_Tower_1_1b860ea19f.jpg","2026-11-13T17:26:00+00:00","2026-11-13T18:00:28.503356+00:00",7,[17,20],{"name":18,"type":19},"Qilin","threat_actor",{"name":21,"type":19},"Aleksey Mikhailovich Yakovtsev","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":22,"icon":24,"name":25,"slug":26},null,"Breaches","breaches",[28,30,35,40],{"category":29},{"id":22,"icon":24,"name":25,"slug":26},{"category":31},{"id":32,"icon":24,"name":33,"slug":34},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":18,"context":48},"malware","Ransomware gang claiming responsibility for the attack.",[],{"controls":51,"vendors":139},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":82,"name":83,"problem":84,"products":85},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"slug":111,"name":112,"problem":113,"products":114},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington","Qilin Ransomware Steals Personal Data from University of Texas at Arlington","The University of Texas at Arlington suffered a ransomware attack by the Qilin gang, resulting in the confirmed theft of personal information belonging to students, staff, or both. Ransomware groups like Qilin typically combine data exfiltration with encryption to maximize leverage — stolen data can be published or sold even if the victim recovers from the encryption. The temporary takedown of the MachForms portal suggests the attack reached internet-facing systems, which often serve as initial access points. Universities are high-value targets because they hold large volumes of sensitive personal, financial, and research data while frequently operating with constrained security budgets. This incident underscores the need for robust data minimization, rapid detection, and a tested incident response plan in higher education environments.",[145,146,147,148,149],"NIST CSF 2.0 RS.MA-01: Incident response plan execution","NIST SP 800-53 SI-4: System Monitoring","CIS Control 3: Data Protection (v8)","NIS2 Article 21(2)(b)","GDPR Article 32",{"GDPR Article 32":151,"NIS2 Article 21(2)(b)":152,"CIS Control 3: Data Protection (v8)":153,"NIST SP 800-53 SI-4: System Monitoring":154,"NIST CSF 2.0 RS.MA-01: Incident response plan execution":155},"GDPR Article 32 requires appropriate technical and organisational measures to protect personal data, including controls that could have prevented or limited the exfiltration of individuals' information in this attack.","NIS2 requires entities to have incident handling capabilities, which would cover the detection, containment, and notification obligations triggered by this ransomware and data-theft event.","Applying data minimization, classification, and access restrictions to personal data would have reduced the volume of information available for the attackers to exfiltrate.","Continuous monitoring for anomalous outbound transfers or ransomware behavior would have provided earlier detection before significant data was stolen.","A tested incident response plan would have enabled faster containment of the Qilin attack and reduced the window during which personal data could be exfiltrated."]