The University of Texas at Arlington (UTA) has confirmed that hackers stole personal information about students and employees during a cyberattack that began in late October. A university spokesperson told The Record by Recorded Future News that the school's investigation confirmed the theft. The university would not say what kinds of data were taken or how many people are affected. UTA is one of the oldest and largest universities in Texas, with more than 41,000 undergraduate and graduate students. The Qilin ransomware gang claimed the attack this week. The university has not publicly confirmed that Qilin was involved.
What Happened
Local reports citing the university's cybersecurity website say the problem first appeared on October 27, when MachForms became unavailable. MachForms is the online form platform UTA uses for event registrations, questions from prospective students, service requests and surveys. The Office of Information Technology started investigating right away. On Wednesday, October 29, it began work to restore services. The university notified students and employees the next day, Thursday, October 30. That first notice said the incident "may have involved unauthorized activity" in some university IT systems. It did not say whether other systems were affected. As of November 4, the cybersecurity page had not been updated since that Thursday notice.
The situation changed in the week of November 10. Homeland411 reports that on November 12, independent researcher Dominic Alvieri posted that Qilin had breached UTA and shared what he described as sample files from the stolen data. The Record then reported the Qilin claim, and the university confirmed that data had been stolen.
The spokesperson said MachForms is still offline and that the university "continues to monitor for additional impacts to university systems or operations." Homeland411 also reports that the university has stopped the attackers from moving between campus servers. The university has not said this publicly.
What Was Taken
UTA has confirmed that personal information about students and employees was stolen. It has not said what data types were involved or how many records or people are affected. No outlet has published a figure. "We are working to determine whose information may have been involved and the nature and extent of the information accessed," the spokesperson said. The university says it will contact affected people directly once it identifies them. It plans to explain what happened, what steps people can take to protect themselves, and what support the university will offer.
Reports differ on how far notification has gone. Some secondary sites describe students and staff as already told that their data was stolen. The Record's account, which quotes the university, says the school is still working out who is affected, so individual letters have apparently not gone out yet.
Because MachForms handled event registrations, inquiries from prospective students, service requests and surveys, the exposed data could include contact details and whatever people typed into those forms. Neither the university nor Qilin has said which data sets the gang holds. The samples Alvieri says he saw have not been independently checked by any established outlet.
Why It Matters
Qilin is one of the busiest ransomware operations active today. Data from the Halcyon Ransomware Research Center, cited by The Record, links the group to 344 claimed attacks between July and September 2026, the second-highest number of any group. Qilin recently also claimed an attack on the US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The Record notes that law enforcement has put some pressure on the group: one of its leading affiliates was recently arrested in Japan and extradited to Germany. The listing of UTA suggests that pressure has not slowed the operation down.
Qilin uses double extortion, meaning it steals data before or instead of encrypting systems, then threatens to publish it. UTA is also one of several universities hit by data-theft attacks in recent weeks. SiberMagazin points to York University in Canada, which confirmed the theft of web form data going back several years. Universities collect large amounts of personal data through scattered, lightly managed tools such as form builders, survey platforms and event systems. Old submissions often stay stored long after anyone needs them, and that turns a small departmental tool into a large data-theft target.
The Attack Technique
The university has not said how the attackers got in. All public information points to MachForms as the first system affected. It was the first system to go offline and is still down. Homeland411 describes MachForms as a self-hosted PHP form builder used by departments across campus, and says the attackers misused administrative web applications to pull out databases. That account has not been confirmed by the university or by any established security outlet. No CVE, misconfiguration or stolen-credential route has been publicly linked to this incident.
Defenders should treat the entry point as unconfirmed. The pattern still matters: a web form application facing the internet, holding years of stored submissions, is exactly the kind of system data-theft gangs go after.
What Organizations Should Do
- List every form builder and survey tool you run. Include self-hosted PHP apps that departments set up on their own. Confirm each one is supported, patched and has an owner.
- Set retention limits on form submissions. Delete or archive old entries on a schedule so that a breach exposes months of data, not years.
- Lock down admin interfaces. Put form-builder admin panels behind single sign-on with multi-factor authentication or a VPN, and keep them off the open internet.
- Separate web applications from the rest of the network. Keep public-facing form servers off the internal network and limit their database accounts to the tables they need.
- Watch for large outbound transfers. Alert on unusual data volumes leaving web and database servers. Qilin's model relies on stealing data quietly before anyone notices.
- Prepare notification workflows in advance. Map which systems hold which personal data so you can identify affected people quickly, and not weeks after the attack has been confirmed.
Sources: University of Texas at Arlington warns personal information stolen... | Texas Üniversitesi Arlington doğruladı: geçen ayki siber saldırıda... | UTA Probes Breach Disrupting MachForms Platform We are the Frontier | University of Texas at Arlington potwierdza kradzież danych po atak... | UT Arlington Breached by Qilin Ransomware as Campus MachForms Data... | UTA Investigates Suspected Cyberattack After MachForms Service | Universidade do Texas em Arlington confirma… HIFY Radar | Check UT Arlington Accounts After Hackers Steal Personal Data