BGMEA University of Fashion and Technology (BUFT)

Our threat intelligence platform flagged unusual activity originating from a prominent dark web forum on August 26, 2018. We noticed a data dump explicitly referencing BGMEA University of Fashion and Technology (BUFT), a significant educational institution in Bangladesh. What struck us was the relatively low, yet specific, number of records exposed, coupled with the inclusion of password hashes. This indicated a targeted compromise rather than a broad-spectrum data scrape, raising immediate concerns about potential credential stuffing attacks against the university's user base and associated systems.

The breach, affecting the official Student Management System (SMS) portal for BUFT, resulted in the exposure of 3,943 records. The compromised data includes email addresses and MD5 password hashes. The source structure suggests a direct database exfiltration, likely through a vulnerability within the SMS application or its underlying infrastructure. The presence of MD5 hashes, while considered weak by modern standards, remains a significant risk as they are susceptible to rainbow table attacks and brute-force decryption, especially when paired with common password patterns. This type of data is often repurposed for combolists, increasing the attack surface for credential stuffing against other online services used by the university's students and staff.

While this specific incident involving BUFT did not generate widespread news coverage at the time, the broader trend of educational institutions being targeted for student data is well-documented. Research by organizations like the Identity Theft Resource Center consistently highlights the education sector as a prime target for data breaches due to the sensitive nature of personal information held. The use of MD5 hashes, as observed here, is a recurring theme in older breaches, often resurfacing in combolists sold on illicit marketplaces. Such data can be leveraged by threat actors for phishing campaigns, unauthorized access to other systems, and identity theft.