UniCursos, Brazil Listed by tengu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 23, 2025, UniCursos, a Brazilian education provider based in São José dos Campos, was listed by the ransomware group known as tengu. Public reporting indicates that the group claims to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed.

The listing places UniCursos among organisations whose data the group asserts it has taken and may publish or sell. For students, staff and partners who interact with the provider, the claim raises concrete questions about what information may now be outside the organisation’s control and what practical steps follow.

Inside the incident

According to the available record, UniCursos, Brazil was listed by tengu on or around October 23, 2025. The group’s claim states that internal files were exfiltrated as part of a ransomware attack. No confirmed figures for the volume of data, the precise date of intrusion, the initial access method, or the number of individuals whose information may be involved have been released publicly. Whether the organisation has confirmed the incident, paid a ransom, or recovered systems is likewise undisclosed. The only concrete public element is the leak-site listing itself, which remains an unverified claim by the threat actor.

Who is tengu?

Tengu is a ransomware group that operates under a double-extortion model: it encrypts systems and simultaneously claims to steal data, then threatens to publish or auction the material if payment is not made. Like other groups of this type, tengu maintains a leak site where it posts victim names and, in some cases, samples of stolen files to increase pressure. Public reporting over recent years has associated the group with opportunistic targeting of organisations across multiple sectors and countries, often after initial access via phishing, exposed remote services or compromised credentials. The group’s listings are claims; independent verification that data was in fact taken from any given victim is frequently unavailable at the time of the announcement. No statements attributed to tengu beyond the listing of UniCursos appear in the public record of this incident.

Who is UniCursos, Brazil?

UniCursos is a private education provider that offers preparation courses for public-sector competitive examinations. It serves students in São José dos Campos and surrounding municipalities in the state of São Paulo. Organisations of this kind typically maintain records of enrolled students, payment information, contact details, academic progress and, in some cases, identity documents required for exam registration. They also hold internal administrative files covering staff, contracts and operational systems. A ransomware incident at such a provider can therefore affect both the continuity of courses and the personal data of people who have entrusted the organisation with sensitive information for career-related purposes.

The information in question

The public claim states only that “internal files” were exfiltrated. No inventory of specific data categories—such as student names, identity numbers, financial records, email addresses or staff files—has been confirmed. Education providers that prepare candidates for public examinations commonly store enrolment data, contact information, payment histories and supporting identity documents. Whether any of those categories were among the files claimed by tengu remains unconfirmed. Until a verified disclosure or official statement appears, the exact contents of the alleged exfiltration cannot be stated as fact.

The real-world impact

If internal files containing personal data were taken, affected individuals face the ordinary risks associated with unauthorised exposure: possible use of contact details for phishing, attempts to open accounts or commit fraud with identity information, and the longer-term inconvenience of monitoring financial and official records. For UniCursos itself, the incident may disrupt course delivery, require system restoration, and create regulatory notification obligations under Brazilian data-protection rules. Because the scale and precise contents remain unknown, the practical severity for any single person cannot yet be quantified; the risk is real but currently unmeasured.

What to do if you're exposed

Anyone who has enrolled with UniCursos, worked for the organisation, or supplied personal documents should treat the listing as a prompt to increase vigilance. Change passwords used with the provider and enable multi-factor authentication wherever available. Monitor bank statements and credit reports for unexpected activity. Be alert to unsolicited messages that reference the school or exam preparation, as these may be phishing attempts. Official guidance from Brazilian authorities or the organisation itself, if issued, should be followed promptly. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, providing an additional early-warning signal.

AICompiled with AI assistance from public sources and published under our editorial standards.