The Qilin ransomware group has added Oral Roberts University to its data-leak website, claiming the private Christian university in Tulsa, Oklahoma, as a new victim. The listing, reported on 11 November 2026, names the university's official domain, oru.edu, and carries a countdown timer suggesting the group may publish allegedly stolen information if negotiations fail.

Qilin has disclosed no volume of allegedly stolen information, no number of affected files and no categories of data involved. No sample files or supporting evidence have been provided with the listing, and it is not possible from the available information to establish whether Qilin accessed the university's systems, took sensitive information, or encrypted university systems. Oral Roberts University has not publicly confirmed a new security incident, and no breach notice letters or state attorney general filings about this claim had been published at the time of reporting.

Double-extortion pressure

Qilin operates a leak site that publicly names alleged victims and threatens to release stolen information when negotiations fail, a model known as double extortion. The pressure comes from the threat of publication as much as from any encryption, and a countdown timer is an extortion mechanism, not technical proof that data was stolen. The claim should therefore be treated as an unverified allegation until the university or an independent source confirms an intrusion.

Universities are frequent targets for this kind of attack because they run large, open networks serving many users and hold student, employee, financial aid and payroll records. If identity-related records were accessed, those affected could face impersonation attempts, targeted phishing and financial fraud, but none of those categories has been confirmed as compromised in this case.

A separate earlier incident

Oral Roberts University previously disclosed a separate data theft incident dating back to December 2024. In that case, an unauthorised party accessed certain systems and took data over three days, from 15 to 17 December 2024, and the university notified people on 19 February 2025. The information involved in that earlier incident included names and Social Security numbers, and the university offered complimentary credit monitoring. Nothing reported so far connects that earlier incident to the November 2026 Qilin listing, and the two should not be treated as the same event.

Students, former students, faculty and staff connected to the university should watch for mail or email from the university, consider placing a fraud alert or credit freeze, review bank and card statements, and be wary of unexpected messages mentioning the incident. Any notification about exposed personal information should be checked through official university channels.