FSE, Cairo University listed by the UmBra ransomware group

Overview

The UmBra ransomware group has listed FSE, Cairo University on its leak blog. The victim page appeared on 8 October 2026, and the indexer that carried the claim records an estimated attack date of the same day. The listing describes the target as an Egyptian higher-education institution focused on arts, music, media and creative education.

What was published

The group's page for this victim claims 163 GB of exfiltrated data. At the time of capture:

• No file listing, sample documents or database preview were published.
• No ransom demand, deadline or negotiation status were shown.
• No breakdown of what the 163 GB contains, and no split between personal, academic and administrative material.

UmBra is an emerging group. The indexer that carried the claim marks it as a new actor whose listings should be treated with caution until independently verified.

Risks for affected individuals

• A record set of this size would typically hold student files, staff records and internal documents.
• Contact details and academic identifiers can be reused for phishing aimed at students and staff.
• Institutions that have not published on the incident cannot warn the people whose data may be involved.

What remains unknown

• Whether the 163 GB figure is accurate, and whether the data was actually taken.
• Which systems were affected, and whether the faculty has opened an investigation.
• Whether the incident is linked to any earlier intrusion. Two other Cairo University incidents are already tracked separately, a Faculty of Graduate Studies listing from January 2025 and a 284,000-record database offered in April 2026. They involve different actors and different dates.
• Whether Egyptian authorities have been notified.

What affected people should do

• Treat unexpected email or phone contact that mentions the faculty with caution.
• Report suspicious messages to the institution's IT or security team.
• Watch for notices about credential or personal data exposure, and change any password that is reused elsewhere.