EPS FUJ Private School UAE targeted by Bqtlock ransomware group

• Ransomware group: Bqtlock
• Country: United Arab Emirates
• Sector: Education
• Announcement date: October 11, 2025

Bqtlock claims attack on EPS FUJ Private School UAE

The Bqtlock ransomware group has officially listed EPS FUJ Private School UAE on its dedicated leak site. According to the announcement made on October 11, 2025, the threat actor claims to have successfully targeted the institution. The group has issued a ransom demand of 50 XMR in exchange for the return of access or to prevent further exposure.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host announcements regarding new victims, sometimes including screenshots or lists of stolen files to increase the psychological pressure on the targeted organization. In this instance, the group has signaled its involvement in an incident affecting a prominent educational institution in the United Arab Emirates.

Details of the claimed encryption and breach

The threat actor known as Bqtlock claims that the systems belonging to EPS FUJ Private School UAE have been encrypted. This process typically involves the unauthorized use of cryptographic algorithms to lock files, rendering them inaccessible to the legitimate users of the organization. The group alleges that the scope of the attack is significant, claiming that all servers and data belonging to the institution have been compromised.

The status of the data remains uncertain pending the resolution of the ransom demand. While the group asserts that the systems are under their control, the actual impact on the organization's digital infrastructure remains to be fully verified. The incident was announced on the same day it was claimed to have occurred, October 11, 2025.

Data involvement and specifics

Regarding the specific information targeted during the attack, the exact nature of the compromised or encrypted data has not been specified by the group. The listing does not provide details regarding the volume of files or the total size of the data exfiltrated. However, the group has provided a screenshot indicating that the data is private and encrypted.

• No specific data types were named in the listing.

In many modern ransomware campaigns, threat actors employ a method known as double extortion. This tactic involves not only encrypting the victim's files to disrupt operations but also stealing sensitive information beforehand. The threat actors then threaten to leak this stolen data on public forums if the ransom is not paid. This adds a layer of risk, as the organization faces the potential exposure of private information even if they can restore their systems from backups.

About EPS FUJ Private School UAE

EPS Fujairah Private School is a private educational institution operating in the city of Fujairah, United Arab Emirates. The school provides academic education services at the primary and secondary levels, serving the local community through its academic programs.

Impact and sector implications

This incident may pose a risk to the operational continuity of an institution operating in the education sector. When educational institutions are targeted, the disruption can affect daily academic activities and administrative functions. Furthermore, ransomware attacks could jeopardize the privacy of student and staff data, potentially leading to identity theft or targeted phishing attacks against the individuals involved.

The organization may face legal reporting obligations under United Arab Emirates data protection regulations following such an incident. Organizations in the education sector often manage vast amounts of sensitive personal information, making them attractive targets for cybercriminals. To mitigate such risks, it is common for organizations to implement defensive measures such as regular offline backups, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access early.

Public information regarding the Bqtlock group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future movements. The uncertainty surrounding the data and the methods used highlights the evolving nature of threats facing the education sector globally.