Our Analysts Found the Universite d’Antananarivo Database Circulating With 739 Student Records

HEROIC analysts identified a database attributed to Universite d'Antananarivo, Madagascar's largest public university, circulating on underground channels. The breach, dated October 1, 2024, exposed 739 records containing email addresses, phone numbers, first names, last names, and plaintext passwords. The presence of plaintext passwords in an academic institution's database represents a serious security failure, one that puts students and staff at direct risk of account takeover across every platform where they reuse those credentials.

Why This Is Dangerous

University databases present an attractive target because they aggregate personal information for a population that frequently reuses passwords across institutional and personal accounts. When plaintext passwords are involved, there is no technical barrier between the stolen data and an attacker's first login attempt. Students and faculty whose credentials appear in this dump are immediately vulnerable, not just on university systems but on email, social media, and financial platforms where the same password is in use.

What Was Exposed

• Email addresses (739 records)
• First names and last names
• Phone numbers
• Plaintext passwords (unencrypted, immediately usable)

Why This Matters

For the individuals in this dataset, the consequences are immediate and multi-layered:

• Credential stuffing: Plaintext passwords with matching email addresses are immediately tested across banking, email, and e-commerce platforms using automated tools.
• Account takeover: An attacker with your email password can reset access to nearly every other online account tied to that address.
• Identity theft: Full name combined with email and phone number is sufficient to impersonate a person on many platforms, apply for services in their name, or bypass identity verification.
• Fraud: Phone numbers enable SIM swapping attacks, which allow attackers to intercept SMS authentication codes and bypass two-factor security.

How Database Breaches Work

Database breaches at educational institutions commonly occur through SQL injection attacks against aging web infrastructure, exploitation of unpatched content management systems, or compromised administrative credentials. Universities often run a mix of legacy and modern systems, and not all of them enforce encrypted password storage. In the case of Universite d'Antananarivo, the plaintext nature of the exported passwords suggests the application layer stored credentials without applying a hashing algorithm, a fundamental deviation from secure development practice. Once extracted, the database was packaged and distributed on dark web forums, where it was observed by HEROIC's monitoring infrastructure.

Check If You Are Affected

HEROIC's breach database contains over 400 billion compromised records gathered from thousands of known breaches worldwide, including incidents affecting educational institutions. If you or someone you know has an association with Universite d'Antananarivo, or if you have used the same email and password on multiple platforms, search your email address now. Acting quickly, by changing passwords and enabling two-factor authentication, is the most effective step you can take to limit exposure.