Mansoura University: Alleged Database Leak on DarkForums

Overview

On 18 September 2026, a database allegedly linked to a faculty of Mansoura University in Egypt was offered for download on the DarkForums.as underground forum. The poster, a low-activity account active under the name whitefreelogs, claimed the file holds 30,000 lines of records and tied the leak to the university's official domain mans.edu.eg. The leak is not confined to a single forum post; separate security trackers have also drawn attention to Mansoura University data exposure in the same period.

What was published

According to the forum listing, the leaked database holds 30,000 rows tied to a faculty of the university. The poster did not enumerate which fields are present in the file. Given the institutional context, the dataset appears to be academic in origin, likely involving student or staff records.

Independent reporting on the wider exposure has described other volumes: one tracker estimated a database on the order of 11GB, while another reported a smaller set of around 731 contact records. These figures are not confirmed and may describe separate listings, subsets, or a different faculty within the same institution.

Risks for affected individuals

Students and staff whose records sit in a leaked institutional database may face: - targeted phishing that references the university or its staff - credential-reuse attempts if login details were part of the dump - identity misuse where national or academic identifiers appear

What remains unknown

The exact faculty affected is not confirmed. The number of distinct individuals represented in the 30,000 rows is unclear, and it is not known whether the data was exfiltrated externally or copied through internal exposure. The accuracy of the claimed line count has not been verified.

What affected people should do

Students and staff of Mansoura University should change institutional passwords and remain alert to phishing that references the university. They should monitor official university statements, review financial accounts where relevant, and report suspicious messages instead of clicking embedded links.