tengu ransomware group lists UniCursos, Brazil on its leak site

• Ransomware group: tengu
• Country: Brazil
• Sector: Education
• Announcement date: October 23, 2025

A new victim listed on a ransomware leak site

The Brazilian educational institution UniCursos has been listed on the leak site operated by the ransomware group known as tengu. According to an announcement published on October 23, 2025, the threat actor claims to have successfully gained access to the institution's data. This development follows a pattern common in modern cyberattacks, where groups utilize dedicated leak platforms to pressure organizations by threatening to release sensitive information.

Ransomware attacks often involve a strategy known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of releasing this stolen information on a public leak site serves as additional leverage to compel the victim to meet ransom demands. While the listing on the tengu platform confirms the group's claim of access, the full extent of the breach remains to be determined.

The claims made by tengu

The announcement regarding UniCursos was made on October 23, 2025, the same day the group claimed to have carried out the attack. The threat actor, identified as tengu, has officially listed the institution on its platform, marking a significant escalation in the cyberattack. At this stage, the group has asserted that they have obtained access to the internal data belonging to the institution.

Publicly available information regarding the specific methods, tools, or vulnerabilities utilized by the tengu group remains limited. This lack of transparency is common among ransomware operators who often maintain a low profile to avoid detection and law enforcement intervention. The group's primary method of operation involves claiming responsibility for the breach to maximize the psychological impact on the target organization.

Details regarding the alleged data breach

Despite the listing on the leak site, the specific nature of the data involved in this incident has not been disclosed. The information provided by the threat actor is currently insufficient to determine the exact scope of the exposure. The screenshot associated with the listing contains general information regarding the institution's area of operation but does not provide any specific data samples to substantiate the claims.

The listing names no data types.

About UniCursos

UniCursos is an educational institution located in Brazil. It specifically operates in the state of São Paulo, serving the area of São José dos Campos and its surrounding regions. The institution specializes in providing preparation courses designed for individuals seeking to take public sector exams.

Potential risks and organizational implications

The potential leak of an educational institution's data can lead to significant secondary risks for the individuals involved. For students and employees, the exposure of sensitive information may result in identity theft or make them targets for highly specific, or targeted, phishing attacks. When attackers possess information about an organization's internal structure or its clients, they can craft much more convincing social engineering campaigns.

From a legal and regulatory perspective, the institution may face serious consequences. Under Brazil's LGPD (General Data Protection Law), organizations are required to implement strict security measures to protect personal data. A data security breach of this nature could lead to legal sanctions under this framework. Furthermore, for entities operating in the education sector, the exposure of sensitive information can result in substantial reputational damage and significant operational disruptions.

To mitigate such risks, organizations typically focus on several defensive layers. This includes implementing robust access controls to ensure that only authorized personnel can reach sensitive data, maintaining regular offline backups to recover from encryption, and conducting continuous monitoring to detect unauthorized exfiltration. Additionally, educating staff on the dangers of phishing can help prevent the initial entry that often leads to such large-scale data breaches.