Universidade Federal de Sergipe listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Brazil
• Sector: Education
• Announcement date: February 26, 2026

The Universidade Federal de Sergipe, a prominent public higher education institution in Brazil, has been listed on a leak site operated by the ransomware group known as thegentlemen. The group claims to have successfully breached the institution's systems and exfiltrated a variety of sensitive files, marking a significant potential data breach for the academic entity.

The details of the claimed attack

According to the announcement posted on the group's leak site on February 26, 2026, thegentlemen group alleges they have gained unauthorized access to the university's internal systems. The group claims that this breach occurred around February 19, 2025. While the group has made these claims public, the specific details regarding the method of entry or the exact nature of the intrusion have not been provided in the announcement.

Ransomware groups often utilize a tactic known as double extortion, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on public leak sites, these actors aim to pressure organizations into paying ransoms to prevent the exposure of private information. In this instance, the group has moved to the leak site phase, publicly naming the university as a victim of their operations.

The alleged stolen data

The information claimed to have been stolen by thegentlemen group involves a wide range of sensitive materials. The group asserts that the exfiltrated data contains highly confidential information that could impact various stakeholders within the university community. The specific types of data mentioned in the leak site announcement include:

• Student personal data
• Private personal information
• Scientific projects
• Internal documents

The announcement included a screenshot, though it reportedly only displayed a generic error message from the group's leak site rather than direct evidence of the files themselves. No specific information was provided regarding the total size of the data stolen or the exact number of files involved in the breach. Additionally, there was no mention of a specific ransom demand in the public announcement.

The organization profile

The Universidade Federal de Sergipe is a public higher education institution located in the state of Sergipe, Brazil. Founded in 1967, it holds the distinction of being the state's first public university. The institution is central to the region's academic landscape, conducting extensive academic education and research activities across several different campuses.

Risk assessment and organizational implications

This incident may present significant risks due to the potential exposure of student and staff data. The nature of the alleged leaked information, which includes personal data and scientific research, suggests that the breach could lead to secondary risks such as identity theft or academic fraud. For educational institutions, the loss of scientific projects can also represent a significant blow to intellectual property and research integrity.

Under Brazil's LGPD (Lei Geral de Proteção de Dados), the institution may be subject to specific data breach notification requirements to ensure compliance with national privacy standards. When such breaches occur, organizations typically face the challenge of notifying all affected parties and implementing necessary security measures to prevent future occurrences. Common defensive steps for organizations in the education sector include strengthening network segmentation, implementing multi-factor authentication, and conducting regular security awareness training for staff and students to mitigate the risk of initial access via phishing or other common vectors.

• Identity theft: The exposure of personal information increases the risk of fraudulent activities.
• Academic fraud: The loss of internal documents and research could lead to academic integrity issues.
• Regulatory compliance: The institution must navigate the legal requirements of the LGPD.

Public information regarding the capabilities and specific motivations of the thegentlemen group remains limited, making it difficult to predict their future actions following this listing.