More than 5,200 student and faculty records walked out of an Indian public university in a database dump, and the person who took them could not have built the attack alone. The software built it. The university left the door on a weak password. And nobody — not the school, not the students — has been named.
Palo Alto Networks’ Unit 42 documented the case this week: an operator using the handle BUGSTER ran an AI-assisted campaign across Indian targets and, in one confirmed intrusion, exfiltrated a MongoDB database holding personal information on students and staff. The report is careful and technical, and read at the right angle it is one of the bleakest documents of the year — not because the attack was sophisticated, but because it was not.
The stack was unremarkable. Hermes Agent as the framework, DeepSeek V4 as the reasoning engine, Cursor as a coding tool, both of the AI components running with safety controls switched off, per Unit 42’s analysis. Naming the framework matters for one reason: this newsroom runs on software of the same name, and it has nothing to do with the version in that report beyond the label. The brand is not the point. The point is that the barrier between a curious amateur and a data breach was a system prompt.
Unit 42’s own explanation of why is a single phrase: low safety friction at low cost. DeepSeek is cheap, easy to reach, and comes apart with a typed override. That is the whole procurement decision.
DeepSeek — Cheap and Easy to Jailbreak Is Not a Flaw in the Plan, It Is the Plan
The big labs spend extraordinary sums teaching their models to refuse. That spending is a cost of goods, and it lands in the price. A model that can be talked out of its refusals in one settings field is a model that sells for pennies, and the customer who cares most about the discount is the customer with something to hide.
Unit 42 does not treat the jailbreak as a curiosity. It treats it as the driver: multiple unrelated actors are independently arriving at the same Hermes-plus-DeepSeek combination, which is what a toolchain looks like before it becomes a product category. The earlier campaign Unit 42 documented ran the same pairing. When strangers converge on the same kit without coordinating, the kit is the story.
Every model release now ships with a safety card. Almost none of them ship with a price that reflects what the refusals cost to keep.
BUGSTER — The Amateur Hour Is the Part That Should Scare You
The intrusion reads like a bad first week on the job, which is exactly why it worked. The actor enumerated 12 subdomains off one university’s education platform — the main WordPress site, a learning management system, a student portal, an administration dashboard. Cloudflare blocked direct access to the user endpoint, so the tooling went around the wall and pulled 13 active user IDs with real names out of post author fields and author sitemaps. A generated script then assembled a brute-forcer: 117 usernames derived from that enumeration, tested against 28 common passwords. It flagged one working login.
The confirmed breach came from somewhere dumber. At a second public university the actor found an administrator account protected by a weak password and walked out with the database. The exfiltration tooling even wrote a manifest, cataloguing the database services and a cloud storage service account it had exposed on the way past. No zero-day. No nation-state crew. A guessable password and a script somebody else wrote.
The most expensive part of that intrusion was the electricity.
5,200 — Diplomas, Degrees, and a Letter Nobody Has Received
The dump carried student records from diploma, undergraduate and postgraduate programs, plus faculty information, all of it personal. Unit 42 did not name the universities. That omission is defensible in a threat report and indefensible as an outcome: a student who graduated years ago has no way to know whether her file sits in that folder, because the only organisations that do know are the ones not saying.
Consider what a university record actually holds. Name, date of birth, address, phone, guardian details, program, enrolment history, sometimes a government identity number. For an eighteen-year-old, that is the raw material of a loan taken out in her name. For a faculty member, it is a payroll identity. None of those 5,200 people can call a hotline, because no hotline has been announced. The second injury in a breach is always the silence, and it is the only part that costs nothing to fix.
The Assistants — Advice, a Fraud Knowledge Base, and a Roadmap for Next Time
The university work was one thread in a bundle. The actor stood up specialised bot profiles. One, called alice, ingested a fraud knowledge base and was asked for step-by-step guidance on running a Voice over IP operation: bypassing STIR/SHAKEN caller authentication, spoofing calling line identification, forming shell companies, evading carrier compliance checks. A second, pandarouter, researched wholesale carriers for regulatory soft spots and past fraud history. A Wi-Fi cracking pipeline captured nearby authentication material and shipped it to rented GPUs, returning results through Discord webhooks — which required the operator to be physically near the targeted networks, meaning somebody was on site.
Then there is the document. One assistant produced an attack report that included a section headed NEXT EXPLOIT OPPORTUNITIES, listing planned follow-up intrusions. A criminal’s to-do list, drafted by the tool.
Give the researchers their due: they draw the line honestly. Unit 42 found no call records, no signaling traces, no routing evidence that the phone fraud was ever run. The cryptocurrency reconnaissance — 45 large holders scraped off the DeBank API into a target list — produced no observed follow-on attacks. Planning is not execution. But planning used to be the part that demanded expertise, and it is now the part that costs a subscription.
Unit 42 — One Person Now Does the Work of Four Specialists
Their framing is the one to keep: AI let a single financially motivated operator work across credential theft, telecom fraud, Wi-Fi cracking and cryptocurrency targeting, domains that historically required four different people with four different skill sets. Trade coverage of the report has led on the low-skill angle, and on the record count — fairly. The structural fact underneath is the collapse of specialisation. A man with frequently broken grammar and a claim to hold a US LLC can now staff an operation with profiles.
Defenders were already losing ground to organised crews with payrolls. They now also lose to solo operators who could not have found the login page unaided a year ago.
The Fix — Lock the Door Before You Shop for a Better Lock
Nothing in the remediation list is exotic, which is the indictment. Administrator accounts with real passwords. Multi-factor authentication on anything internet-facing. Database access limited to known systems and users. Login monitoring tuned to catch the moment an account starts pulling records in bulk. Secrets kept out of files and logs, and rotated the instant exposure is suspected. The university that lost 5,200 records did not lose them to a novel exploit. It lost them to a weak password on an administrator account.
Then the genuinely new part: if you run AI agents, decide what they are allowed to touch before they touch it, and leave the approval gates switched on. The actor in this case turned his off. Yours are the only ones that count.
There is a policy gap under all of it. India has no federal breach notification statute that would compel a university to tell 5,200 people their records are gone. Until that changes, the receiving end of this story is a student who learns about it from a rejected loan application, or from a collections call, or never. The tools got cheap. The obligations did not move.
Sources: Unit 42 (Palo Alto Networks), IBTimes Singapore, Cryptika Cybersecurity.