UniCursos, Brazil Listed by tengu Ransomware Group

On October 23, 2025, Brazilian education provider UniCursos appeared on the leak site of the tengu ransomware group, with the attackers claiming to have exfiltrated internal files during a ransomware incident.

What's Publicly Reported from Reporting

Public reporting indicates that UniCursos, which prepares students for public-sector exams in São José dos Campos and surrounding areas of São Paulo state, was listed on the tengu ransomware group's leak portal. The listing states that internal files were taken. No confirmed victim count has been published, and the precise volume or specific types of data remain unclear from available reporting. The incident follows the group's typical pattern of encrypting systems, exfiltrating information, and then publishing samples or announcements when demands are not met.

Why This Matters for You and Your Family

When an education provider that handles enrollment records, payment details, and personal information of students and their families suffers a breach, the consequences reach ordinary households. Your name, address, contact details, and possibly financial or identification data used for course registration could be exposed. For families in the São Paulo region who have used UniCursos to prepare for civil service or other public exams, the breach creates a direct risk that personal records could be sold or misused. Credential leaks like this one often cascade far beyond the original victim organization.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain spreadsheets that link names, emails, phone numbers, addresses, and sometimes national identification numbers. Attackers and subsequent data resellers can combine this information with other breaches to build detailed profiles. A single leaked record can connect your professional exam history to social-media handles, children's school activities, or family addresses. Once chains like these form, targeted harassment, identity theft, or financial fraud becomes significantly easier. Public reporting describes how ransomware leaks regularly feed into larger doxxing marketplaces where everyday families become long-term targets.

Tengu Ransomware Group's Track Record

Public reporting attributes the group's emergence to mid-2024. It has targeted organizations across multiple countries, focusing on mid-sized businesses and public-facing service providers. Notable prior victims include healthcare clinics, manufacturing firms, and other education-related entities. The group's typical playbook involves initial access through phishing or exploited remote desktop services, followed by deployment of ransomware to encrypt systems, aggressive exfiltration of sensitive files, and extortion demands backed by public leak-site pressure. When payments are refused, the group releases samples or full datasets on its onion site, as seen in the UniCursos listing.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the UniCursos breach.
• Rotate any password you used for your UniCursos account anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts, which often become entry points for credential-stuffing attacks after leaks like this.
• Let DoxxScan remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The UniCursos breach is a reminder that even organizations you trust with educational and personal records can become gateways to larger privacy problems. Taking concrete steps now limits how far stolen data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children's gaming accounts that frequently chain back to family credentials.