Skip to content
Leak-site post naming Philander Smith University, captured by ThreatCluster

Philander Smith University

endzone

Ransomware leak-site victim intelligence

Data size
500GB+
Posted
Oct 6, 2026
Country
United States
Industry
Education

Summary

Written by ThreatClusterfrom victim profile, leak post

Endzone states Philander Smith University, a private historically Black liberal arts university in Little Rock, Arkansas, exfiltrated 500GB+ of data, including confidential information about students and staff and financial data, and reports encrypted files across the network. The leak post lists the publication status as countdown. The victim is identified in the leak’s victim profile as a Higher Education institution.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Founded
1877

What was taken

Philander Smith University is a private, historically Black liberal arts institution in Little Rock, Arkansas, founded in 1877 and affiliated with the United Methodist Church. They provide undergraduate and graduate education with a focus on academic excellence, social justice, and leadership development for a diverse student body.

Data categories
confidential information about studentsconfidential information about stafffinancial information

Ransom note

Published by the group on their leak site, reproduced verbatim.

We successfully exfiltrated 500GB+ worth of data which includes VERY confidential information about students and staff, as well as financial information. Alongside, we have encrypted files across the entire network.

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Screenshot of a web interface displaying a search form with fields for billing account, company name, address, phone number, and other details.
onion leak page361 KB
Screenshot of a cable modem properties window displaying status, start date, upload/download speeds, number of CPEs, and a MAC address.
onion leak page102 KB
Screenshot of a customer management interface displaying account information, equipment details, and port status with various metrics highlighted in green and red.
onion leak page559 KB
Screenshot of an account management interface displaying account details, package information, and options to add a new package.
onion leak page278 KB
Screenshot of an account detail page showing information about a commercial internet service, including account status and billing details.
onion leak page281 KB
Screenshot of a customer service dashboard displaying account information, modem status, and equipment details, with various data fields highlighted.
onion leak page396 KB
Screenshot of an account management interface displaying account details and package information for a cable service.
onion leak page235 KB
Screenshot of a cable modem properties window displaying status, start date, upload and download speeds, number of CPEs, and MAC address.
onion leak page103 KB
Screenshot of an account information page displaying account details, including account number, type, status, and billing information.
onion leak page132 KB
Screenshot of a customer service interface displaying account information and a command prompt showing a deletion process.
onion leak page209 KB