Rebornvc ransomware group lists unyleya.edu.br on its leak site

• Ransomware group: Rebornvc
• Country: Brazil
• Sector: Education
• Announcement date: July 8, 2025

Rebornvc claims data breach at unyleya.edu.br

The threat actor known as Rebornvc has officially listed the Brazilian educational institution unyleya.edu.br on its leak site. According to the announcement made on July 8, 2025, the group claims to have successfully executed an attack and obtained sensitive information belonging to the organization. This development follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims into paying ransoms by threatening the release of stolen data.

The claim suggests that the group has acquired various documents belonging to the institution. While the group has asserted that they have access to the data, they have not provided any screenshots to verify the contents of the alleged breach. The announcement was categorized as a data leak, indicating that the primary threat involves the exposure of private information rather than just the encryption of systems.

In an attempt to secure payment, the Rebornvc group has issued a ransom demand of $10,000. This demand is reportedly offered in exchange for the release or the suppression of the stolen data. This tactic is a hallmark of double extortion, a method where attackers not only encrypt an organization's files but also steal sensitive data to use as leverage during negotiations.

Alleged stolen data and contents

While the specific volume and file count of the stolen data have not been disclosed by the attackers, the group has identified several categories of information that they claim to have exfiltrated from the institution. The alleged stolen data includes a variety of sensitive documents that could impact the privacy of the organization's stakeholders.

The items identified in the claim include:

• Invoices
• Contracts
• User information
• Assignments

The inclusion of such diverse data types suggests a broad access to the institution's internal administrative and academic systems. The presence of user information and contracts, in particular, points toward a potential breach of both personal and professional data.

About Centro Universitário Unyleya

Centro Universitário Unyleya is a Brazil-based educational institution. It has been operating in the field of digital education for over 18 years, offering a variety of undergraduate and postgraduate programs to its student body.

Risk assessment and implications

This incident may pose a significant risk to the privacy of the institution's students and employees. The leaked data, if verified and released, could potentially be utilized by malicious actors for identity theft or targeted phishing attacks. When sensitive information such as user details and contracts are compromised, the risk of secondary attacks increases, as criminals can use the stolen context to craft highly convincing fraudulent communications.

Under Brazil's LGPD regulations, the institution may face data breach notification obligations due to the nature of the alleged leak. Furthermore, the double extortion tactic of publishing the data could lead to reputational damage and operational disruptions for the organization. The uncertainty surrounding the group, as information about Rebornvc is limited in the public domain, adds an additional layer of complexity to the situation.

In general, organizations facing such threats often focus on strengthening their defensive postures. Common defensive steps include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff and students to mitigate the risk of phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are critical components of a modern cybersecurity strategy.