Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

University of San Francisco

usfca.edu

Discovered 2026-09-07 21:55 UTC
Est. attack date 2026-09-07
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

usfca.edu zoominfo.com/c/university-of-san-francisco/346496443 is San Francisco's oldest university — a private Jesuit institution founded in 1855, with ~10,200 students, a $428M endowment, and a 55-acre hilltop campus near Golden Gate Park (plus downtown, Pleasanton and Tokyo sites). A 13:1 student-faculty ratio and #1-ranked online professional studies graduate program anchor its academics; 34% first-gen, 55% students of color, 92% on financial aid — mission-driven access defines it. Athletics: Division I Dons (WCC) with 3 national titles — home of Bill Russell's legendary 1955–56 back-to-back NCAA basketball championships. New president Salvador Aceves (2025) — the first Latino in the role — and an R2 "high research activity" Carnegie classification. Tuition ~$62K with average grants of $38K+; alumni median salary $115K. Bottom line: a mission-driven urban Jesuit university blending social justice, elite basketball history and top professional programs — "Change the World From Here.

Infostealer activity detected by HudsonRock

Compromised Employees: 2

Compromised Users: 1068

Third Party Employee Credentials: 99


External Attack Surface: 103


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • mxa-00277301.gslb.pphosted.com. Proofpoint
  • mxb-00277301.gslb.pphosted.com. Proofpoint
TXT Records
  • e2ma-verification=t42cb
  • e2ma-verification=x32cb
  • e2ma-verification=m24cb
  • e2ma-verification=i22cb
  • e2ma-verification=o24cb
  • e2ma-verification=jn2cb
  • e2ma-verification=xe6cb
  • d365mktkey=gqTE1t2GvUhw4qxPRU0R6o5L9iNJ19qjjxHk9xn0orUx
  • e2ma-verification=t32cb
  • apple-domain-verification=kwslev8aAgiulVcq
  • cisco-ci-domain-verification=6b5182c51408e4866dad93bdad042a8ece7f5f103172bba6cfebb2170dc3fce8
  • e2ma-verification=l24cb
  • e2ma-verification=o3veb
  • e2ma-verification=xb2cb
  • e2ma-verification=r24cb
  • e2ma-verification=j24cb
  • v=spf1 ip4:148.163.158.109 ip4:148.163.148.175 include:_spf.google.com ip4:138.202.192.0/24 ip4:35.162.199.78 ip4:34.223.15.128 ip4:184.107.80.0/24 include:amazonses.com ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:216.248.199.106 ip4:216.248.199.105 " "ip4:148.105.8.0/21 include:spf.mandrillapp.com ip4:52.1.96.230 ip4:162.247.216.0/22 ip4:54.186.193.102/32 ip4:75.126.200.128/27 ip4:75.126.253.0/24 ip4:67.228.50.32/27 include:spf1.usfca.edu ~all
  • e2ma-verification=z32cb
  • e2ma-verification=q5oeb
  • e2ma-verification=t5oeb
  • e2ma-verification=w24cb
  • e2ma-verification=r32cb
  • e2ma-verification=s5oeb
  • e2ma-verification=yb2cb
  • e2ma-verification=v32cb
  • dropbox-domain-verification=7a3r3e2d8zbr
  • e2ma-verification=w2veb
  • sending_domain997341=a40f7d9806baf5ec45ba7a55906f002ac5a5a1f73a399d6c4e708f486c2ac558
  • d365mktkey=GShcanL3VeLteRgkowhexG0OS9OS65fD46UQc6tIVBAx
  • google-gws-recovery-domain-verification=3938371
  • e2ma-verification=odzcb
  • e2ma-verification=v24cb
  • google-site-verification=xwu16wglVbJPIMd1PHtER-qX7CZnJ__pAjGSy2CNHSQ
  • e2ma-verification=05oeb
  • e2ma-verification=0e6cb
  • e2ma-verification=ye6cb
  • e2ma-verification=x2zcb
  • e2ma-verification=e5oeb
  • e2ma-verification=232cb
  • e2ma-verification=r3veb
  • e2ma-verification=qdzcb
  • MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCt69aBh8ka2dAGaMfeJetFeQyGgbxilTFwHM2IAJTGOvxd03se3OD8RamYbP8pWvRn8EYghRFb80pYrmzUvBaaESXMomQ4hBs1hoxPqqOquXtwBzUwOIzOYVCgHn1ROuDRmfc4DwEmLCML71v/I8JHyxgTVG9ATc2VJy6dLaArIQIDAQAB
  • e2ma-verification=ue6cb
  • anthropic-domain-verification-aazmky=PXpQyidpT8Rv8mgYGFXMxjQb7
  • e2ma-verification=we6cb
  • e2ma-verification=u5oeb
  • SFMC-ZHcl-Lnmnh-QuVT7ch3tdsCFJZ5qozA7Da3xY5jq
  • apple-domain-verification=yWbrPib4xp1BzBbM
  • e2ma-verification=p24cb
  • e2ma-verification=25oeb
  • e2ma-verification=u24cb
  • adobe-idp-site-verification=589775b6f4dd0b7305bbce8bad7e8ede74572ed918339e1eb305ac22afa4a16c
  • e2ma-verification=k24cb
  • e2ma-verification=v42cb
  • e2ma-verification=h5oeb
  • e2ma-verification=s3veb
  • e2ma-verification=38oeb
  • asv=f34197f45b4b30659789a00f96df35d8
  • google-site-verification=NWpRpVFzZYCTj8RrjnQbRzRa8VO_AlloUqGZwm6NpbI
  • e2ma-verification=n24cb
  • e2ma-verification=35oeb
  • e2ma-verification=ndzcb
  • 7101889C9BD7AE89155D4A89A5349BF3
  • e2ma-verification=ve6cb
  • e2ma-verification=vb2cb
  • e2ma-verification=55oeb
  • e2ma-verification=s24cb
  • e2ma-verification=q3veb
  • e2ma-verification=f22cb
  • e2ma-verification=p3veb
  • e2ma-verification=u42cb
  • e2ma-verification=w42cb
  • e2ma-verification=pdzcb
  • e2ma-verification=wb2cb
Cloud / SaaS Services Detected
Adobe Amazon SES/WorkMail Anthropic Apple Box Cisco Dropbox Mandrill Proofpoint Stripe