UVCI Moodle Database Leaked on DarkForums

Overview

On 5 July 2026, a DarkForums user shared a Moodle database dump from the Virtual University of Côte d'Ivoire (UVCI), specifically the licences3.uvci.online platform. The post credits an actor using the handle Sensitive2025 for the leak. The dump contains user records with account credentials and personal fields.

What was published

The leaked table follows the standard Moodle user schema and includes:

• username, password (bcrypt hashes, $2y$10$ format)
• firstname, lastname, middlename, alternatename
• email, phone1, phone2
• institution, department, address, city, country
• Academic fields: etatuvci, code_rentree, semestre
• Account activity: firstaccess, lastaccess, lastlogin, currentlogin, lastip

Sample rows show student accounts from programs such as ISN-DAS-L2 and ISN-CMD-L2, with Ivorian phone numbers and CI country codes. The lastip field records the IP addresses used to access accounts.

Risks for affected individuals

• Stored bcrypt hashes protect passwords only if they are strong; weak passwords remain at risk of cracking.
• Student names, emails and phones enable targeted phishing and academic fraud attempts.
• IP addresses and access timestamps expose personal activity patterns.

What remains unknown

• The total number of accounts in the dump.
• Which UVCI platforms were affected beyond licences3.uvci.online.
• Whether the university has acknowledged the incident.

What affected people should do

UVCI students and staff should change their platform passwords, use a different password for other services, and be alert to messages that reference their student records or enrollment codes.