UAE’s Amity University Dubai Named in Black Nevas Ransomware Leak Claim

The ransomware group, Black Nevas, has added Amity University Dubai to its victim list. The hacker group claims they hacked into the school’s system and obtained a lot of sensitive information belonging to both students and employees, as well as financial records.

Tracking site Ransomware.live spotted the listing on October 15, 2026. It estimates the attack happened around September 17. That means the claim surfaced about four weeks later.

No public statement from Amity had turned up as of Thursday afternoon. So for now, this is a hacker claim, not a confirmed breach.

What the Group Claims to have Stolen 

The listing names five kinds of data. The first category is personal details of students and staff. This includes names of students and staff members, their dates of birth, addresses, contact numbers, and email addresses. The list also contains claims of photos and passport/ID numbers.

Similar concerns have emerged in another UAE-related data exposure claim, in which a hacker alleged that investor information, including Golden Visa records, had been stolen. The previous report shows in hacker claims theft of UAE investor data, including Golden Visa Records.

Second, it lists academic records. Those cover discipline notes, expulsions, leaves of absence, and scholarship data. Third, it claims financial information, bank account, credit card details, or the history of tuition payments, loans and other sensitive financial info.

The fourth kind of data the hackers listed could put sensitive research and business data at risk. That would include any unpublished studies, sensitive intellectual property, and files that business partners have shared with Amity in confidence. Fifth, it lists contact and financial details for parents and guardians.

There is one major exception, however. Ransomware.live does not show the stolen files. It only reports what the group posts. As a result, no one outside the group has confirmed any of this. The page also shows no data size. A cyber-threat account on X shared the same claim.

Who is Black Nevas?

Black Nevas also goes by Trial Recovery. Security firms first spotted it in November 2024. Researchers say its code comes from an older gang called Trigona. The group uses double extortion.

It locks a victim’s files, and it also threatens to leak stolen data. Reports differ on how it posts that data. Early research said it relied on partner gangs. Newer trackers point to its own leak site.

Its reach keeps growing. Trackers count roughly 47 to 52 victims. Its latest listings before Amity came in September. One was a U.S. mortgage lender, and another was a Turkish business group. So the group stayed busy this fall.

Targets span Asia, Europe, North America, and the Middle East. In the Gulf, the group has listed OTE Group in Oman and Yateem Group in Bahrain. It also listed a UAE firm, Trojan Construction & Holding Group, in October 2025.

Why Schools are Prime Targets for Ransomware Attacks

Universities hold valuable data. Student records, payment details, and research all sit in one place. Analysts say schools often run lean security teams and open networks. Campuses need that openness so people can share work.

The numbers back this up. A September industry report found education was the most targeted sector worldwide. Schools averaged 6,656 attacks per organization each week. That is up 59% from a year earlier.

The UAE feels the pressure too. On August 10, its Cyber Security Council said it stopped coordinated attacks on aviation, energy, and education. It did not name the attackers. Nothing found so far links that campaign to Black Nevas.

About Amity University Dubai

Amity opened in Dubai in 2011 and sits in Dubai International Academic City. It belongs to India’s Amity education group. The UAE’s higher education ministry and Dubai’s education regulator, KHDA, license it.

In 2014, Amity broke ground on a 700,000-square-foot campus. The plan mentions up to 5,000 students, but that’s just what the plan says, not the actual enrollment. So the number of affected people stays unknown.

What Potential Victims Should Do

If you’re a student, a staff, or your child attends Amity University, approach this news with careful consideration. Scammers often use news like this. They’ll likely reach out pretending to be from the school or a bank. So, here’s what you should do:

• Be super skeptical of any messages you get about tuition fees, refunds, or scholarships; they’re often phishing scams.
• Pick up the phone and ring the university on the number listed on their official website, and only that number.
• Never hand over your passwords or one-time access codes to anyone.
• Change the password you use on the school portal and wherever else you’ve reused that same password.
• Monitor your bank and card statements for anything weird.
• Ignore any leaked files floating around online.

What Comes Next

Amity can clear things up fast. It can say whether data left its systems and who is affected. The UAE’s federal data law requires organizations to report breaches that risk privacy.

However, it excludes free zones with their own rules. So it is unclear which rules cover Amity. Whatever the case, people deserve straightforward answers. In the meantime, both students and faculty have the option to inquire from the university if theirs were among the records compromised. Parents who paid tuition via credit card should also consider contacting their bank.

Watch what Black Nevas does next. The group threatens to publish data when victims refuse to pay. So far, the public listing shows only a screenshot. If the group publishes samples, it will become easier to verify the claim. Until that happens, take the listing seriously, but remember, it’s still not a confirmed breach.