Brazilian University Breach: UFSC’s NUTe Portal Leaked 35,306 Logins

HEROIC analysts logged a 2014 breach connected to Núcleo Multiprojetos de Tecnologia Educacional (NUTe), an educational technology center at Brazil's Universidade Federal de Santa Catarina (UFSC). Dated June 13, 2014, the incident exposed 35,306 records containing email addresses, usernames, and passwords stored as a mix of MD5 hashes and plaintext.

Why the UFSC NUTe Breach Is Dangerous

This breach involves two levels of risk at once. Any password stored in plaintext is immediately usable by an attacker with no extra work. Any password stored as an MD5 hash can usually be cracked quickly, since MD5 was never designed to protect passwords and modern hardware can guess billions of combinations per second against it.

What Was Exposed in the UFSC NUTe Breach

• Email addresses
• Usernames
• Passwords stored as MD5 hashes or in plaintext

Why the UFSC NUTe Breach Matters

Students and staff often reuse a single password across university systems, personal email, and other online accounts. An exposed password from an academic platform can be tested against those other accounts through credential stuffing, opening the door to account takeover, phishing aimed at academic email addresses, and identity theft.

How the UFSC NUTe Data Was Exposed

This is a database breach. An attacker gained access to the platform's backend and exported the full user table rather than targeting accounts one at a time. The mix of hashed and plaintext passwords found in the same data set suggests accounts were added over time under inconsistent security practices, which is common on long-running academic platforms.

Check If You Were Affected by the UFSC NUTe Breach

If you ever had an account with NUTe or UFSC's related systems, it is worth checking your exposure. HEROIC's free breach scanner searches more than 400 billion leaked records, including this one, so you can see what was exposed and update any reused passwords.