> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# MSM Unify Extorted for 400,000 Dollars Over Student Passport and Visa Files
- URL: https://darkwebinformer.com/msm-unify-extorted-for-400-000-dollars-over-student-passport-and-visa-files/
- Published: 2026-09-07T16:12:54.000Z
- Updated: 2026-09-07T16:12:54.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report Canada Identity Documents Ransom Demanded 

## MSM Unify Extorted for 400,000 Dollars Over Student Passport and Visa Files

A forum actor posting as **Kazu** claims to hold **1.45 TB** taken from **MSM Unify**, a Canadian education technology platform that helps students apply to universities abroad. The listing gives **2,020,129 files covering 319,163 users** and describes the contents as applicant document packs: **passport copies, passport photographs, birth certificates, visas, refusal notices, school transcripts, English test score cards, offer letters and payment receipts**, alongside names, dates of birth, gender, marital status, citizenship, addresses, mobile numbers and passport numbers with expiry dates. This is **an extortion post rather than a sale**: the actor demands **400,000 dollars by 21 September** and threatens to sell the data otherwise. The claim is **unverified**.

Severity CRITICAL 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Users319,163

Files2,020,129

Ransom$400,000

Deadline21 Sep 2026

### ▣Post details

TargetMSM Unify

CountryCanada

SectorEducation technology

ListingExtortion, not for sale yet

Volume1.45 TB, 2.02M files

Dump dateStated as 2026

ObservedSep 7, 2026

ActorKazu

### !What the post claims

- 1.45 TB of data
- 2,020,129 files
- 319,163 users
- Passport copies
- Passport numbers and expiry
- Passport size photographs
- Birth certificates
- Visa documents
- Refusal notices
- School transcripts
- English test score cards
- Offer letters
- Payment receipts
- Names and dates of birth
- Gender and marital status
- Citizenship
- Addresses and mailing addresses
- Mobile numbers and emails
- Ransom of 400,000 dollars
- Deadline of 21 September
- Sale threatened if unpaid
- Samples offered privately

### ◱Screenshot

[ ![Forum post demanding a ransom over student application documents attributed to a Canadian education platform, September 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/273895697286357892359876239876592873.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/273895697286357892359876239876592873.png) 

Forum post demanding payment over MSM Unify data, observed 7 September 2026.

### ☷Mapped techniques

Mapped from the actor's own account. Claimed, not confirmed.

- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Inferred Structured applicant fields and document packs are described together, which spans an application system rather than a single store.
- Collection [T1530](https://attack.mitre.org/techniques/T1530/) Data from cloud storage Inferred Two million files against three hundred thousand users indicates a document repository was taken in full, roughly six uploads per applicant.
- Impact [T1657](https://attack.mitre.org/techniques/T1657/) Financial theft Stated A sum, a deadline and a consequence are all named, which makes this an active demand rather than a listing.

### ⚠Potential impact

A passport copy, a birth certificate, a passport photograph and full personal details in one folder is **a complete identity kit per person**, assembled by the applicant themselves and impossible to reissue away. The population makes it worse: **international student applicants are already the target of immigration and admissions fraud**, and refusal notices and visa documents disclose exactly who has been rejected, which is the opening for approaches promising to fix an application for a fee. Notification will also be difficult, since these people are **spread across many countries and were applying rather than enrolled**, so the platform may have no current relationship with them at all.

### iStatus Unverified

This is **a live negotiation conducted in public**, so the post is a pressure instrument first and a listing second, and its details are chosen to be persuasive to the victim rather than checkable by anyone else. **No sample appears in the thread**, only an offer to supply one privately, and no intrusion method or date is given beyond the year. The same actor listed another platform's data the previous week, so a pattern is forming. Dark Web Informer has **not retrieved the data and is not linking the samples or contact addresses**, and MSM Unify has not publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=msm-unify-2026-09-07&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=msm-unify-2026-09-07&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=msm-unify-2026-09-07&utm%5Fcontent=footer) // Threat Intelligence