UT Arlington confirms data theft, Qilin claims the attack

The University of Texas at Arlington (UTA) has told students and employees that attackers stole personal information during a cyberattack last month, according to The Record. The Qilin ransomware group has claimed responsibility. UTA — one of Texas's largest universities, with more than 41,000 students — has not yet said what data was taken or how many people are affected. No vendor advisory applies here; this post is based on the university's statement and reporting.

What UTA has confirmed

The university says attackers accessed its systems and took personal information, but it is still "determining whose information may have been involved and the nature and extent of the information accessed." It has not published a figure for the number of people affected. UTA took its MachForms portal — used for event registration, service requests, and surveys — offline, and it remained down at the time of reporting.

Who claimed it

The Qilin ransomware-as-a-service operation has claimed the attack on its leak site, as reported by The Record and corroborated by CySecurity News. Treat that as a claim, not confirmed attribution: leak-site listings are unverified, and UTA has not named an actor. Qilin has been among the most active ransomware brands of 2026 — tied to 344 alleged attacks between July and September, per Halcyon data cited by The Record.

What to do today

1. If you are a current or former UTA student or employee, watch for a direct notification from the university and act on the protection steps it provides.
2. Assume exposure of standard directory and enrollment data (name, contact details, potentially SSN or student ID) until UTA scopes the breach, and consider a credit freeze if you were in affected systems.
3. Peer institutions: review external exposure of form/portal apps like MachForms and any internet-facing file-upload surfaces, which are a recurring Qilin entry point.
4. Watch for follow-on phishing that references UTA or the breach itself.

Context

Education remains one of Qilin's most-hit verticals this year, alongside healthcare and local government — a pattern driven by sprawling IT estates, thin security staffing, and troves of personal data that make for effective extortion leverage. UTA's public silence on scope is standard for the first week of a ransomware disclosure; the detail that matters for affected people — what was taken — typically lands only with the formal breach notice. Until then, the Qilin listing is the only "what" on offer, and it is the attacker's account, not the university's.