All ransomware incidents
Ransomware group ShadowByt3$ hits Knottingham Trent University
Knottingham Trent University — a education target operating in GB has been listed by the ShadowByt3$ ransomware group on 2026-08-25. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Knottingham Trent University |
|---|---|
| Threat Group | ShadowByt3$ |
| Summary | We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have been breached they locked out are access after stealing the following below High-Risk Sensitive PII - Passport Numbers & Details: Stolen via the raw PDF copies of the applicants' physical passports - Dates of Birth: Specifically exposed on the main data profile screen - Nationalities & Countries of Birth: Confirmed via the legal passport logs and the registration metadata fields. Contact & Location PII - Full Legal Names: Animesh Shukla and Abhinand Unnikrishnan - Personal Email Addresses: Exposed via the portal login view (`amita.shukla@leveragemails.com`). - Mobile Phone Numbers: Explicitly collected on the dashboard contact view (`7080809422`). - Permanent & Correspondence Home Addresses: Complete street-level addresses mapping out exact house numbers, apartment complexes, districts, and postal ZIP codes spanning across Lucknow (226001) and Delhi (110024). Academic & Professional History PII - While non-sensitive on its own, hackers use this deeply personal context to write highly convincing scam letters - Complete Academic History: Stolen via the raw transcript files (`Degree Transcript.pdf` `10TH`, and `12TH` grade completion papers), showing exact grade percentages, modules studied, and prior school names. - Employment & Professional History: Stolen directly out of the `CV.pdf` file, mapping out their previous job titles and career timelines - Professional Reference Names: Stolen via the Letters of Recommendation (`LOR.pdf`), which reveal the names, titles, and institutions of the professors or employers who recommended them. mirror 1: https://anonfilesnew.com/s/FXB5-I_XtWl mirror 2: https://pixeldrain.com/u/XXWv2geH This is a warning to all companies to comply it's that easy and simple. If you don't we will leak you and ruin your reputation and make sure that everyone abuses your companies data. |
| Date of Breach | 2026-08-25 |
| Discovery Date | 2026-08-25 |
| Region | GB |
| Target Domain | ntu.ac.uk |
| Business Sector | Education |
| Severity | MEDIUM |
Claim by ShadowByt3$
We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have been breached they locked out are access after stealing the following below High-Risk Sensitive PII - Passport Numbers & Details: Stolen via the raw PDF copies of the applicants' physical passports - Dates of Birth: Specifically exposed on the main data profile screen - Nationalities & Countries of Birth: Confirmed via the legal passport logs and the registration metadata fields. Contact & Location PII - Full Legal Names: Animesh Shukla and Abhinand Unnikrishnan - Personal Email Addresses: Exposed via the portal login view (`amita.shukla@leveragemails.com`). - Mobile Phone Numbers: Explicitly collected on the dashboard contact view (`7080809422`). - Permanent & Correspondence Home Addresses: Complete street-level addresses mapping out exact house numbers, apartment complexes, districts, and postal ZIP codes spanning across Lucknow (226001) and Delhi (110024). Academic & Professional History PII - While non-sensitive on its own, hackers use this deeply personal context to write highly convincing scam letters - Complete Academic History: Stolen via the raw transcript files (`Degree Transcript.pdf` `10TH`, and `12TH` grade completion papers), showing exact grade percentages, modules studied, and prior school names. - Employment & Professional History: Stolen directly out of the `CV.pdf` file, mapping out their previous job titles and career timelines - Professional Reference Names: Stolen via the Letters of Recommendation (`LOR.pdf`), which reveal the names, titles, and institutions of the professors or employers who recommended them. mirror 1: https://anonfilesnew.com/s/FXB5-I_XtWl mirror 2: https://pixeldrain.com/u/XXWv2geH This is a warning to all companies to comply it's that easy and simple. If you don't we will leak you and ruin your reputation and make sure that everyone abuses your companies data.
Posted by the ShadowByt3$ threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
ntu.ac.uk
Leak post (onion / Tor)
tor
https://transfer.it/t/dqbRpEkBmbxB
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.