Back to Victim Disclosures

University of British Columbia

Published
1h ago

Added Oct 20, 2026

We are ShadowByt3$ 2.0. We have hacked you. Contact us and negotiate or we will leak the following and our contact is below: contact: ShadowByt3S@proton.me - Administrator: The registered admin email belongs to markturin@gmail.com. 2. WordPress Database Infrastructure The file outlines the creation schema and raw data blocks for several standard database tables using the ap_2_ prefix: - ap_2_options: The largest chunk of the file, containing core site settings, active plugin configurations, serialized widget spaces, security notifications, and cron schedules. - ap_2_comments & ap_2_commentmeta: Stores reader comments. Currently contains only the default placeholder comment ("Hi, this is a comment...") from "A WordPress Commenter". - ap_2_links: Holds structural blogroll links. - Third-Party Plugin Tables: Structural blueprints for extended features, such as ap_2_ninja_table_items (for Ninja Tables layout grids), ap_2_imagelinks, and ap_2_e_events. 3. Active Theme & Plugin Ecosystem The settings reveal the exact environment the site is utilizing: - Active Theme: It runs a theme called Airi (and references historical testing of Twenty Twenty and clf-basic). - Active Plugins: A serialized array lists core components active on the site, including Elementor (page builder), Contact Form 7, Kirki Toolkit, and Mailchimp for WordPress. - Site Feeds: It caches several localized technical news feeds, structural error logs, and recent WordPress core beta testing reports. 4. Technical Server Commands (File 2) The attached command log tracks an administrator manually managing the server environment on a Linux backend: - Database Management: Importing and exporting database backups (db_backup.sql, db_backup_newsite.sql). - File Permissions: Tweaking ownership rights across the backend directory structures (wp-admin, wp-content, wp-includes). - Server Maintenance: Upgrading the PHP version (switching to PHP 8.1), updating the WordPress CLI interface, clearing system caches, and deploying a local instance of phpMyAdmin to inspect the tables visually. - Migration Scripts: Executing broad global search-and-replace terminal operations to migrate site strings and absolute paths from an older testing subdomain (heiltsuknew.arts.ubc.ca) back to the main domain (heiltsuk.arts.ubc.ca).

Leak Page Screenshot

Organization Details

Organization

University of British Columbia

Domain

heiltsuknew.arts.ubc.ca

Country

🇨🇦 CA

heiltsuknew.arts.ubc.ca

Leak Data

Published

Oct 20, 2026

Publication Status

Published

Discovered

Oct 20, 2026

Leak URL
http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion
Site OnlineLast scanned 5m ago

Threat Group

ShadowByt3$

ransomware group

View full group profile →

Quick Facts

Country🇨🇦 CA
AddedOct 20, 2026