An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday.   The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Angeion Group LLC will contact affected individuals about submitting claims under Columbia's $16.1 million settlement over the breach. 

The Motive Behind Cyberattack 

In June 2025, the hacker told Bloomberg they were looking for evidence that Columbia still used affirmative action in admissions after the Supreme Court struck down the practice in 2023. The same hacker claimed responsibility for a March 2025 breach at New York University, where admissions data was posted to NYU's website. That data purported to show that Asian and white students admitted to NYU had higher average GPAs and test scores than admitted Black and Hispanic students.  About a month after the cyberattack on Columbia University, the school agreed to share applicants' admissions data with President Donald Trump's administration. The move was part of a broader deal to restore federal funding that had been canceled over allegations of campus antisemitism.  The hacker stole contact information, Social Security numbers, health data, and financial aid data belonging to around 870,000 Columbia applicants and affiliates. In September, the University agreed to pay $16.1 million to settle a class action lawsuit over the breach. 

Settlement Terms for the Cyberattack on Columbia University 

A federal court overseeing the settlement appointed Angeion Group, LLC, as claims administrator. The group has launched a website with settlement information and will send claim instructions to affected individuals. Columbia directed questions about the process to Angeion Group.  Each plaintiff may claim two years of credit monitoring services and either an estimated $100 payment or up to $8,500 in reimbursement for documented losses.  The court granted preliminary approval in September. Affected individuals have until Dec. 22 to submit objections, comments, or exclusions. An exclusion removes a person from the plaintiff group but preserves their right to take independent legal action against Columbia. Claims are due in late January, and a final approval hearing, where the court will review objections and decide whether the settlement is reasonable, is set for Feb. 23, 2027. 

Security Upgrades After the Columbia University Cyberattack 

In its Friday statement, Columbia said it took “proactive steps to strengthen our data security and governance practices” after the attack, adding that the settlement includes a commitment to further enhancing cybersecurity.  The University worked with cybersecurity companies to recover its compromised systems. In June, it said it was removing Social Security numbers of nonaffiliates from its systems “subject to relevant legal restrictions.”  A University official told Spectator that Columbia has since increased network segmentation, which divides networks into smaller sections to contain threats. The official said the school also deployed additional endpoint detection and response tools, which monitor systems in real time to flag unusual activity.  “We regret the concern that this incident has caused our community and believe the actions we have taken and commitments we have accepted in the agreement reflect the seriousness with which we are approaching this matter,” the statement concludes. 

A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak.

The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unauthorized external access to the Yonsei Portal Service,” the office stated.

What the Yonsei University Cyberattack Exposed 

The compromised data included student identification numbers, mobile phone numbers, and email addresses, along with system management details such as login identification keys and the number of failed password attempts on affected accounts. Resident registration numbers were not exposed. 

From 1 p.m. Thursday, affected individuals could check on Yonsei University’s official website which details were compromised. 

Two Hacking Attempts in Less Than a Day 

The cyberattack on Yonsei University reportedly began at around 7:41 p.m. on Tuesday. 

“An attack on the university’s system was detected at the time, and we immediately blocked the IP [internet provider] address,” a university representative told the JoongAng Ilbo. “While we were analyzing the cause at around 10 a.m. the following day, a second hacking attempt was made from a different IP address, which we also blocked.” 

Yonsei reported the incident to the Personal Information Protection Commission (PIPC) on Wednesday afternoon. The Personal Information Protection Act requires organizations to report a personal data breach within 72 hours of becoming aware of it and to notify affected individuals. 

“We plan to gather additional evidence related to the hacking attacks and refer the case to investigative authorities,” the representative said. 

The university also plans a comprehensive security review of its systems, along with stronger monitoring and security measures. It urged students and graduates to be wary of text messages, phone calls, and emails claiming to be from the university, and to avoid clicking links from unknown sources or entering personal information on suspicious websites. 

Sogang University and a Wider Pattern of Breaches 

The cyberattack on Yonsei University follows a series of attacks on higher education institutions. On Aug. 14, Sogang University suffered an external cyberattack that exposed approximately 180,000 records containing personal information of students, graduates, and university staff, according to a notice posted on the Sogang University website. 

The problem goes beyond recent cases. According to data the Ministry of Education submitted to People Power Party Rep. Kim Meen-geon, personal data breaches at universities affected 2.8 million people between 2022 and July this year. 

Calls for Support After Yonsei and Sogang University Incidents 

Experts have called for more cybersecurity personnel and greater funding as hacking attacks grow increasingly sophisticated, including through the use of AI. 

“Just as the government develops information security measures for small- and medium-sized businesses, it should establish support measures to strengthen cybersecurity at universities,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Support appears particularly necessary for private universities that lack sufficient funding for cybersecurity.” 

site-verification-ok

Supermarket freezers that cooked their own stock overnight. Text messages about traffic fines that quietly steal payment PINs. North Korean IT workers paying Americans to keep remote jobs at U.S. companies. This weekly cybersecurity roundup brings together incidents that reached well beyond stolen data, causing spoiled food, store fires, disrupted grocery deliveries and drained bank accounts. Here are the stories that shaped the week.

Hackers Turned French Supermarket Freezers Into Ovens Overnight

Hundreds of French supermarkets woke up to spoiled stock after hackers took remote control of internet-connected refrigeration systems overnight. Retailers confirmed on Monday that attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F) while stores were closed. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, keeping units heating instead of cooling. The attack did not use a new exploit. It targeted ageing connected devices still online years after their manufacturer stopped supporting them. E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit. At least 300 Intermarché and Netto stores were affected, Coopérative U reported more than 100, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, noted that estimates sit around 400 stores, with some branches reporting losses of about €250,000. Some reports put the total above 500 shops. Read More

Fake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India

GhostBat RAT, an Android malware strain first identified by Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI, wallet and fintech apps. It spreads through SMS messages about unpaid traffic challans that lead victims to fake mParivahan download pages, with GitHub repositories also used to host the malicious files. Cyble's research also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution. Many of the fake apps are first-stage loaders that hide the real payload in encrypted files or download it later, helping them pass initial scans. Read More

Death Threats, Laptop Farms, Stolen IDs: Inside North Korea's Job Scam

North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, according to an updated FBI public service announcement. The Justice Department also announced charges, two arrests and the seizure of about 187 computer devices linked to the scheme. The FBI said Americans are being hired to appear on camera, sit for job interviews, verify fake identities, lend social media or professional networking accounts, ship packages, complete drug tests or fingerprint submissions, and keep work laptops running from their homes. The workers also use stolen identities, extort victims and threaten physical violence. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, which helps fund its nuclear weapons and military programs. Read More

Ahold Delhaize Incident Disrupts Grocery Supply in Netherlands and Belgium

A cyber incident at Ahold Delhaize has disrupted parts of the grocery retailer's IT infrastructure, prompting it to take some systems offline. Stores remain open, but reports from the Netherlands and Belgium indicate disruption to distribution, customer service and some delivery operations. The company has not disclosed the nature of the incident or whether customer or employee data was affected, and it has given no timeline for full recovery. Ahold Delhaize operates in nine countries, employs more than 384,000 people and owns U.S. brands including Food Lion and Stop & Shop. Read More

Kerala Police Signs MoU With Cyble for Cybercrime Investigations

Kerala Police has signed a three-year Memorandum of Understanding with Cyble to bring threat intelligence into cybercrime investigations. The agreement, signed through Cyble Infosec India Private Limited and announced on October 12, 2026, covers intelligence support, investigative assistance and capacity building. It will support the Kerala Police Cyber Operations wing and Cyberdome in identifying and investigating emerging threats. Read More [caption id="attachment_114716" align="aligncenter" width="600"] Image Source: Cyble[/caption]

Seoul National University Reports 28 Hacking Incidents Since 2021

Seoul National University has suffered 28 hacking incidents since 2021, exposing more than 1,100 pieces of personal information belonging to students, faculty and staff. The figures come from data the university submitted to Rep. Baek Seung-ah of the Democratic Party. There were eight attacks in 2021, a peak of 10 in 2022, none in 2023, one in 2024 and five in 2025, with four confirmed so far this year. Departmental systems were hit most often, in 19 incidents, followed by laboratory systems with six, research systems with two and one institutionwide system. Read More

Morocco Prioritizes AI Threats and Critical Infrastructure Defense

Morocco is placing greater focus on proactive threat detection, critical infrastructure protection and artificial intelligence in its cybersecurity strategy. Speaking at the opening of National Cybersecurity Week in Rabat, Abdellatif Loudiyi, Minister Delegate in charge of National Defense Administration, said cybersecurity must be built into institutional governance rather than treated as an extra expense. He called for stronger preparedness, early detection and coordinated incident response. The event runs from October 12 to 14. Taken together, this week's incidents show attackers targeting the systems people rely on every day, from shop refrigeration and grocery supply chains to payment apps and hiring processes. Follow The Cyber Express for next week's weekly cybersecurity roundup and ongoing coverage of these stories. Read More

Seoul National University (SNU) has been struck by 28 hacking incidents since 2021, and more than 1,100 pieces of personal information belonging to students, faculty and staff were exposed along the way. The SNU cyberattack figures come from data the university submitted on Sunday to Rep. Baek Seung-ah of the Democratic Party.  The breakdown shows eight attacks in 2021 and 10 in 2022, the highest annual total in the period. Activity then dropped sharply to a single incident in 2024 before rising again to five in 2025. Four more have been confirmed so far this year. Together, these yearly figures account for all 28 incidents, which means none were recorded in 2023.  Departmental systems were the most frequent target, hit in 19 of the 28 incidents. Laboratory systems came next with six, followed by research systems with two. One attack affected an institutionwide system. 

2021 SNU Cyberattack Behind Nearly All Leaked Data 

Across the six-year span, a total of 1,132 pieces of personal information were leaked. Almost all of them, 1,130 records, trace back to a single cyberattack in 2021. In that breach, hackers planted malicious software on SNU servers, which let them run commands remotely and steal personal details of university members, including their portal IDs.  The remaining two pieces of personal information were exposed in 2024, when attackers went after a university research institute. Their focus was on files containing researchers' biographies and résumés.  According to the data, no personal information leaks were confirmed in any of the other hacking incidents. 

Seoul National University Faces Hundreds of Attempts Every Year 

Beyond the confirmed breaches, the university has dealt with a steady stream of attempted intrusions, numbering more than 500 annually in recent years. SNU logged 561 hacking attempts in 2024 and 575 in 2025. Another 588 have been detected so far this year, already exceeding the totals of both previous years.  Explaining the numbers, the university said, "These figures represent hacking attempts detected and blocked through our security monitoring." It added, "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures." 

How SNU Handled Reporting After Hacking Incidents 

On the question of reporting, SNU said it notified either the Ministry of Education or the Personal Information Protection Commission whenever a personal information leak was confirmed. However, the university has never requested an investigation by law enforcement authorities into any of the attacks.  The disclosure offers a clearer picture of the digital threats confronting a major South Korean university. While the number of successful breaches has fallen since its 2022 peak, the yearly count of attempted attacks has continued to climb.   That trend suggests the pressure on Seoul National University's networks remains significant, and the SNU cyberattack record is likely to keep questions about how the institution safeguards its community's data in focus. 

Osaka Metropolitan University has suffered a ransomware attack that disrupted the university’s information infrastructure and left major systems unavailable. The university said the incident began in the early hours of October 2, 2026, and has affected its website, email, campus network and several systems used for education and administration. According to the university, a large-scale failure occurred within its virtualization infrastructure on October 2. The incident initially rendered many information systems unusable. The university later determined that the disruption was caused by a cyberattack, specifically a ransomware attack. The university established a crisis management headquarters on the same day, led by President and Vice Chairman Hiroyuki Sakuragi. External specialists are supporting the investigation into the cause of the attack and the extent of the damage. The outage has affected a broad range of services, including the campus network, OMU email, corporate and university websites, educational support systems, academic affairs systems, financial accounting systems, human resources and payroll systems, and library systems.

Data of 130,000 Students and Teachers May Be Exposed Due to Ransomware Attack

Japanese media reported that data belonging to at least 130,000 current and former students and teachers at the institution may have been exposed to unauthorized access following the cyberattack. The university has not yet confirmed whether personal information was leaked. It said an investigation is underway to determine whether any personal information was compromised and to establish the facts surrounding the incident. The university said it will report the matter to Japan’s Personal Information Protection Commission and proceed with further fact-finding based on an investigation by a specialized company.

Osaka Metropolitan University Works to Restore Operations

Osaka Metropolitan University said it is prioritizing the investigation, damage assessment and restoration of affected systems. It is also using alternative measures to maintain essential operations and provide support to students, prospective students, business partners and other stakeholders. The university has temporarily established an announcement site because its official website, email system and other services remain unavailable. The temporary site is being used to publish information from Osaka Metropolitan University, the National College of Technology and affiliated hospitals. The university is also preparing for classes to resume from Friday, October 9, and has asked students to check the temporary announcements for information regarding the resumption of classes.

Japanese Organizations Face Recent Cyber Incidents

The Osaka Metropolitan University ransomware attack comes amid several recent cyber incidents disclosed by organizations in Japan. Over the weekend, Japanese media giant Nikkei disclosed that a compromised employee account had been used to send approximately 9,000 malicious emails to internal and external contacts, including journalistic sources. Other Japanese organizations that have recently disclosed cyber incidents include brokerage Daiwa Securities, delivery companies Yamato Transport and Sagawa Express, insurer Dai-ichi Life and broadcast equipment manufacturer Ikegami Tsushinki. Osaka Metropolitan University said it has reported the incident to the Ministry of Education, Culture, Sports, Science and Technology, the Osaka Prefectural and Osaka City governments, and JPCERT. The university said it will provide further information as new facts emerge.