UT Arlington confirms personal data stolen in cyberattack; Qilin claims the intrusion

The University of Texas at Arlington told students and employees that personal information was taken in a cybersecurity incident last month. A spokesperson said the investigation confirmed theft, then declined to name the fields or how many people were hit. The school is still sorting whose records were involved and what was accessed, and said it will contact those people directly with protection steps. MachForms, a portal used for event registration, service requests, and surveys, was taken down when the incident was first announced and is still offline. The university said it is watching for further effects on systems or operations.

The evidence trail splits cleanly. The university has confirmed data loss and has not named an actor. The Qilin ransomware gang claimed the intrusion this week. That is a criminal-group statement, not an independent technical attribution from the school or from a named incident-response report in the public record. Halcyon Ransomware Research Center figures cited alongside the claim put Qilin at 344 alleged ransomware attacks from July through September 2026, second among groups tracked. Researchers this week named Russian national Aleksey Mikhailovich Yakovtsev as a Qilin leader. A leading affiliate was arrested in Japan and extradited to Germany. Nationality and a gang boast are not the same thing as state direction, and this record does not show state direction.

UT Arlington is one of Texas’s oldest and largest universities, with more than 41,000 undergraduate and graduate students. It lands in a run of campus incidents with different actors and different levels of confirmation. York University said attackers took student information going back more than a decade. Vanderbilt said restoring normal operations would likely take multiple weeks and is still checking whether data left the network, prioritizing payroll, payments, admissions, registration, and public safety. The BYOD gang claimed Vanderbilt plus Michigan State and the University of New Mexico. Qilin separately claimed an attack on the Bureau of Alcohol, Tobacco, Firearms and Explosives. Those claims stay gang statements unless the institutions confirm them.

The people in the blast radius are students and employees whose records sat on university systems, including a forms tool used for ordinary campus business. The school has confirmed that personal information was stolen and has not published the inventory. Until direct notices name individuals and data types, the confirmed exposure is an unidentified slice of a campus that enrolls more than 41,000 students, plus staff. The operational fact already on the board is narrower and harder: a routine identity-rich portal is still down, and the university has acknowledged theft without saying what left.