Coop UQAM Listed by Rhysida Ransomware Group

On April 29, 2025, the rhysida ransomware group added Coop UQAM to its public leak site, claiming that internal files had been exfiltrated from the large university-affiliated cooperative in downtown Montreal.

What Public Reporting Shows

Coop UQAM serves primarily university students and staff at UQAM while also offering membership to individuals and businesses. Public reporting indicates the group claims to have stolen internal documents during a ransomware incident. The exact number of people whose information appears in the files remains unknown. Available reporting describes the exposed material as internal files rather than a structured database of customer records. The leak site listing appeared on April 29, 2025, and follows the group’s typical pattern of publishing samples after an initial extortion window.

Why This Matters for You and Your Family

Even when a breach does not publish millions of records, the files can contain contracts, membership applications, payment details, or correspondence that include names, addresses, phone numbers, and email accounts. If you or your children have ever shopped, joined as a member, or used services at Coop UQAM, fragments of your information may now sit in an attacker-controlled archive. Once that data leaves the cooperative’s control, it can be sold, traded, or combined with other leaks. For families, a single exposed email or phone number often becomes the starting point for phishing texts, fake account-recovery requests, or unwanted data-broker listings that follow your family for years.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one organization. A leaked membership form might list a parent’s email address alongside a child’s student ID or gaming username. Attackers and data brokers routinely link these fragments across breaches. An email from the Coop UQAM files can be cross-referenced with a credential leak from a past gaming site or streaming service. The result is an identity chain that reveals home addresses, family relationships, and online handles. Public reporting shows these chains frequently lead to doxxing, account takeovers, and targeted harassment. Credential leaks like this one cascade into account takeovers when the same password has been reused elsewhere, especially on gaming platforms popular with children and teenagers.

Rhysida’s Publicly Known Track Record

Public reporting attributes the rhysida ransomware group with emerging in 2023. The group has listed hospitals, universities, municipalities, and retail organizations in its leak portal. Its typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by claimed exfiltration of internal files before encryption. Rhysida then demands payment and, if unpaid, publishes samples or full archives on its onion site. The group’s extortion style combines data leaks with threats to contact customers or regulators. Exact success rates are difficult to verify, but the volume of victims listed on ransomware.live indicates a persistent operation.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what the Coop UQAM files may have exposed.
• Rotate any password you ever used at Coop UQAM or any university-related service, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become the weakest link in identity chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your family’s daily digital life.

The Coop UQAM incident illustrates how even a single cooperative’s membership files can feed larger doxxing campaigns that touch ordinary families. Taking concrete steps now limits how far those files can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next leak appears.