EPS FUJ Private School UAE Listed by bqtlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target educational institutions worldwide, exploiting the sector’s combination of sensitive personal records, limited cybersecurity budgets, and operational pressure to keep systems running. Against that backdrop, a private school in the United Arab Emirates has appeared on a ransomware leak site, raising questions for families, staff and the wider community about what may have been taken and what comes next.

On 11 October 2025, the organisation known as EPS FUJ Private School UAE was listed by the ransomware group bqtlock. Public detail remains limited: the number of people affected is unknown, and the only data category named is internal files said to have been exfiltrated during a ransomware attack. The listing references the school’s domains epsfuj.com and www.epsfuj.com. Whether the claim is accurate, how the intrusion occurred, and what specific records were involved have not been independently confirmed.

What happened

According to the available record, EPS FUJ Private School UAE was listed by the bqtlock ransomware group on 11 October 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access vector, the encryption status of systems, or any ransom demand—have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. The only organisational identifiers supplied are the domains epsfuj.com and www.epsfuj.com. At present, the listing itself constitutes an unverified claim by the threat actor rather than a confirmed forensic finding.

Inside bqtlock

bqtlock is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the stolen material if a ransom is not paid. Like other groups of this type, bqtlock maintains a leak site on which it posts victim names and, in some cases, sample files or full archives. Public reporting on the group’s earlier activity shows a pattern of opportunistic targeting across multiple sectors rather than a narrow focus on education. Claims posted on such sites are made by the attackers themselves and should be treated as assertions until corroborated by the victim organisation or independent investigators. No statements attributed to bqtlock beyond the listing of this school appear in the available facts.

About EPS FUJ Private School UAE

EPS FUJ Private School UAE is a private educational institution operating in the United Arab Emirates. Schools of this kind typically manage records covering enrolled students, parents or guardians, teaching and administrative staff, and sometimes alumni. Those records routinely include names, contact details, dates of birth, academic histories, health or special-needs information, and financial or fee-related data. Because the institution serves minors and their families, any compromise of its systems carries heightened sensitivity. A breach at a school can affect not only day-to-day operations but also the trust that parents place in the institution’s ability to safeguard children’s information. Public detail about the school’s size, exact location within the UAE, or prior security posture is not supplied in the breach record.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of personal data categories have been released. Organisations in the education sector commonly hold student enrolment forms, parent contact lists, staff personnel files, academic transcripts, medical or safeguarding notes, and financial records. Whether any of those categories were among the files claimed by bqtlock remains unconfirmed. Until the school or an independent investigation publishes a verified list, the precise contents of the exfiltrated material should be regarded as unknown.

What's at stake

For individuals whose information may have been taken, the practical risks include unwanted contact, phishing attempts that exploit knowledge of school affiliation, and, in more serious cases, identity-related fraud if government identifiers or financial details were present. Parents and staff may also face secondary social or professional exposure if private correspondence or performance records surface. For the school itself, the consequences can include regulatory scrutiny under UAE data-protection rules, disruption of teaching and administrative systems, and long-term reputational damage that affects enrolment and community confidence. Because the scale of the incident is undisclosed, the full extent of these risks cannot yet be quantified.

If your data was in this claimed breach

If you are a parent, student, or staff member connected to EPS FUJ Private School UAE, treat the listing as a prompt for caution rather than confirmed proof that your own records were taken. Practical first steps include:

• Monitor bank and credit-card statements for unfamiliar activity and enable transaction alerts where available.
• Be sceptical of unsolicited emails, messages or calls that reference the school or claim to offer “breach assistance.”
• Change passwords on any accounts that reused credentials also used for school portals, and enable multi-factor authentication.
• Request a free exposure scan of your email address against known breach data sets to see whether your information has already appeared elsewhere.
• Contact the school’s administration through official channels if you need confirmation of what, if anything, was affected.

Public information about this incident remains sparse. Further clarity will depend on any statement the school chooses to issue and on subsequent independent reporting. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.