MSM Unify Extorted for 400,000 Dollars Over Student Passport and Visa Files
A forum actor posting as Kazu claims to hold 1.45 TB taken from MSM Unify, a Canadian education technology platform that helps students apply to universities abroad. The listing gives 2,020,129 files covering 319,163 users and describes the contents as applicant document packs: passport copies, passport photographs, birth certificates, visas, refusal notices, school transcripts, English test score cards, offer letters and payment receipts, alongside names, dates of birth, gender, marital status, citizenship, addresses, mobile numbers and passport numbers with expiry dates. This is an extortion post rather than a sale: the actor demands 400,000 dollars by 21 September and threatens to sell the data otherwise. The claim is unverified.
▣Post details
!What the post claims
- 1.45 TB of data
- 2,020,129 files
- 319,163 users
- Passport copies
- Passport numbers and expiry
- Passport size photographs
- Birth certificates
- Visa documents
- Refusal notices
- School transcripts
- English test score cards
- Offer letters
- Payment receipts
- Names and dates of birth
- Gender and marital status
- Citizenship
- Addresses and mailing addresses
- Mobile numbers and emails
- Ransom of 400,000 dollars
- Deadline of 21 September
- Sale threatened if unpaid
- Samples offered privately
◱Screenshot
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Collection T1213 Data from information repositories Inferred Structured applicant fields and document packs are described together, which spans an application system rather than a single store.
- Collection T1530 Data from cloud storage Inferred Two million files against three hundred thousand users indicates a document repository was taken in full, roughly six uploads per applicant.
- Impact T1657 Financial theft Stated A sum, a deadline and a consequence are all named, which makes this an active demand rather than a listing.
⚠Potential impact
A passport copy, a birth certificate, a passport photograph and full personal details in one folder is a complete identity kit per person, assembled by the applicant themselves and impossible to reissue away. The population makes it worse: international student applicants are already the target of immigration and admissions fraud, and refusal notices and visa documents disclose exactly who has been rejected, which is the opening for approaches promising to fix an application for a fee. Notification will also be difficult, since these people are spread across many countries and were applying rather than enrolled, so the platform may have no current relationship with them at all.
iStatus Unverified
This is a live negotiation conducted in public, so the post is a pressure instrument first and a listing second, and its details are chosen to be persuasive to the victim rather than checkable by anyone else. No sample appears in the thread, only an offer to supply one privately, and no intrusion method or date is given beyond the year. The same actor listed another platform's data the previous week, so a pattern is forming. Dark Web Informer has not retrieved the data and is not linking the samples or contact addresses, and MSM Unify has not publicly addressed the claim.
Dark Web Informer // Threat Intelligence
