ChimeraZ claims leak of ISEP user database with 5,088 people across 5,091 JSON records
A threat actor using the handle ChimeraZ claims to have leaked a user dataset linked to ISEP, a French engineering school specializing in digital technology, computer science, electronics and cybersecurity. The listing advertises 5,091 lines covering 5,088 people in a 720 KB JSON dataset, with multiple download mirrors provided. The data, its source, the stated counts and its current availability have not been independently verified. The material does not show how the data was obtained or establish unauthorized access to ISEP systems. If authentic, the exposed fields could support targeted phishing, impersonation or other social-engineering activity against ISEP students and staff.
Technical Details
- Three files are referenced:
2.6K_utilisateurs.json,2.4K_utilisateurs.jsonand37_utilisateurs.json. - Claimed fields include names, employee or student type, institutional email addresses, internal identifiers, city, country, activity status and timezone information.
- The actor reportedly uses Session rather than Telegram for contact, but no Session ID is visible in the supplied capture. No malware hash, Tox ID or attacker-controlled IP address is visible.
- The source maps the activity to T1213.006 (Data from Information Repositories: Databases) as an analytical inference, not a confirmed behavior.
Remediation
- ISEP should validate the claim by checking whether the sample records match its user directories and identifying the possible source system.
- Affected users should be warned about phishing and impersonation attempts that use institutional email addresses.
- Defenders should monitor for abuse of the exposed identifiers and email addresses until the claim is confirmed or refuted.
Linha do tempo
-
ChimeraZ claims leak of ISEP user database with 5,088 people across 5,091 JSON records
ler a análise desta fonte ocultar
A threat actor using the handle ChimeraZ claims to have leaked a user dataset linked to ISEP, a French engineering school specializing in digital technology, computer science, electronics and cybersecurity. The listing advertises 5,091 lines covering 5,088 people in a 720 KB JSON dataset, with multiple download mirrors provided. The data, its source, the stated counts and its current availability have not been independently verified. The material does not show how the data was obtained or establish unauthorized access to ISEP systems. If authentic, the exposed fields could support targeted phishing, impersonation or other social-engineering activity against ISEP students and staff.
Technical Details
- Three files are referenced:
2.6K_utilisateurs.json,2.4K_utilisateurs.jsonand37_utilisateurs.json. - Claimed fields include names, employee or student type, institutional email addresses, internal identifiers, city, country, activity status and timezone information.
- The actor reportedly uses Session rather than Telegram for contact, but no Session ID is visible in the supplied capture. No malware hash, Tox ID or attacker-controlled IP address is visible.
- The source maps the activity to T1213.006 (Data from Information Repositories: Databases) as an analytical inference, not a confirmed behavior.
Remediation
- ISEP should validate the claim by checking whether the sample records match its user directories and identifying the possible source system.
- Affected users should be warned about phishing and impersonation attempts that use institutional email addresses.
- Defenders should monitor for abuse of the exposed identifiers and email addresses until the claim is confirmed or refuted.
- Three files are referenced: