A leak shop calling itself DYSPHOR1A has listed a dataset it attributes to the University of Delhi, at a $450 starting bid, credited jointly with a handle called LidaBroker. Listings like this appear steadily, and education providers across South and Southeast Asia have been a routine feature of them for years. Most resolve into a partial dataset, recycled data, or nothing.
What the Listing Claims
The entry, referenced ID_DELHI-DU, claims a compromised internal university records system holding student personal data, academic records, enrolment data, identification documents and contact details, and says the two handles are "selling the full database of student records." Payment is in ETH, BTC or XMR, negotiated over Session. This is a shop rather than a ransomware pressure blog. No encryption event is implied and there is no deadline, only a sale.
What the Field List Shows
The published columns include uni_email, wifi_email and other_accounts, alongside membership, enrolment, department, course and completion. Around them sits an approval workflow made up of form_id, applied_on, status and rejection_reason.
Those fields describe an account provisioning form. An applicant requests a university email address, campus network access and library or facility membership, and an administrator then approves or rejects the request. A student information system would be keyed on enrolment identifiers and would not carry a per-row rejection reason.
The sample rows agree with the columns. All are research scholars at M.Phil. and Ph.D. level across History, Operational Research, Punjabi, Hindi and Education, with one entry from an administrative branch carrying no course at all, which indicates the form serves staff as well as scholars. Contact addresses in the sample are personal or shared departmental mail accounts rather than university ones, which is what an application for a university address would look like before approval.
One further detail supports a third-party origin. The table carries titre, prenom and nom, French for title, first name and surname, as well as a separate name column. That pattern is characteristic of a localised open-source or vendor form module with a locally added field, which would place any other deployment of the same component in scope.
The Document Fields Are the Real Exposure
Six columns cover uploaded identity material: photo_file, id_front_file and id_back_file, with matching photo_url, id_front_url and id_back_url. Applicants were uploading a photograph and both sides of a government identity document, and the table records both a stored path and a retrievable URL for each.
That changes the harm assessment. A contact table creates a fraud targeting problem. Identity document images, held next to a matching photograph, name, mobile number and enrolment number, are usable for account opening and verification bypass, and none of that material can be reissued.
It also raises a question the database itself does not answer. If those URLs resolve without authentication, the document images are exposed regardless of whether anyone buys the dataset, and they stay exposed until the storage is locked down. If the URLs are sequential, they can be enumerated. Both conditions can be tested immediately.
