Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Northwestern Polytechnic

nwpolytech.ca
Group Thegentlemen
Discovered 2026-10-09 19:23 UTC
Est. attack date 2026-10-06
Country CA
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

nwpolytech.ca zoominfo.com/c/northwestern-polytechnic/1310919676 Northwestern Polytechnic (NWP) is a publicly funded polytechnic institution founded in 1966 in Grande Prairie, Alberta, serving 3,800+ students (2,227 full-load equivalents) with ~372–438 employees under President & CEO Dr. Vanessa Sheane (since 2023). Its annual budget is ~$79.5M CAD (2026-27), funded 62.5% by government grants and 21.9% by student tuition, with total net assets of $49.8M (CRA data). NWP operates across 4 schools (Applied Science & Technology, Business & Education, Health, Skilled Trades) offering apprenticeships, diplomas, and a new Bachelor of Education degree, plus unique research assets like the National Bee Diagnostic Centre — Canada's only bee diagnostics lab (NSERC Technology Access Centre) — and a 40,000 sq ft Health Education Centre inside the Grande Prairie hospital. The campus features iconic Douglas J. Cardinal architecture (winner of the Prix du XXe Siècle)
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 32

Third Party Employee Credentials: 15

External Attack Surface: 7

Exposure Report
by ParanoidLab
295
Passwords
36 critical
8
Cookies
0 critical
Last queried 2026-10-09 19:23 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • mthiessennwpolytech.ca
  • abusegodaddy.com
MX Records
  • nwpolytech-ca.mail.protection.outlook.com. Microsoft 365
TXT Records
  • d365mktkey=7nx3MJItSWMwmfkzARx4CMIb9aSbkZmsZjaxKjTS5ZEx
  • google-site-verification=K1CgFmZVXdVuvulFRvLHcDQI7Wz_JCe__Tcu9HalEEk
  • v=spf1 ip4:192.139.30.239/32 ip4:192.139.30.35/32 ip4:192.139.30.37/32 include:a._spf.brightspace.com include:spf.protection.outlook.com include:_spf.explore-blue.com include:a._spf.brightspace.com ~all
  • google-site-verification=aU8j1tfW1ytAwSDEjqAw3KnMKcO3RfQDJRP4rZwwsiU
  • ta43t9k960pppnnhofcbnoeidj
  • selector1-nwpolytech-ca._domainkey.gprc.onmicrosoft.com
  • apple-domain-verification=Ovt5svZA6p8jn6XL
  • ZOOM_verify_7VRpKvm9kPaBmERakylNIw
  • knowbe4-site-verification=4367d652f42b73f824e35b8e996e0059
  • selector2-nwpolytech-ca._domainkey.gprc.onmicrosoft.com
  • MS=ms20209739
Cloud / SaaS Services Detected
Apple KnowBe4 Microsoft 365 Zoom

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.