The University of Texas at Arlington is investigating a cybersecurity incident that has kept its MachForms platform offline for more than a week. The university uses MachForms for event registration, prospective-student inquiries, service requests and surveys. In an Oct. 29 notice, UTA said it had found "potentially unauthorized activity" in some of its IT systems. It said it took immediate steps to mitigate the incident and is working with external cybersecurity experts and law enforcement.
The notice raises as many questions as it answers. The university has not said what caused the incident, who is behind it, whether any data left its network, or when the affected systems will come back. Below is what is confirmed, what is not, and what campus IT teams and anyone who deals with UTA should do now.
What happened, and when?
The university's own status log is the most precise timeline available. It lists MachForms as offline from Tuesday, Oct. 27, with technicians investigating, and as still unavailable on Oct. 28 while the team implemented corrective measures. UTA's public notice followed on Thursday, Oct. 29. It says the university discovered the incident that week, that MachForms remains unavailable, and that other webpages and IT systems are also affected. UTA said it is still investigating whether there are additional impacts to its systems or operations.
The campus newspaper, The Shorthorn, reported that the Office of Information Technology (OIT) began corrective measures on Wednesday, Oct. 28, the day before the notice went out. The paper also reported that as of Tuesday night, Nov. 3, the university had posted no updates on its cybersecurity page since Thursday.
The Cyber Express covered the incident on Nov. 4. It reported that the university has not said how long the investigation will take or when full service will be restored.
What is MachForms, and why does its outage matter?
MachForms is a web form builder. Organizations use it to build the online forms people fill out to sign up for events, ask questions or submit requests. UTA says it uses MachForms to give students, faculty, staff and the public a way to submit information through the university's website, and to route that information to the right departments or systems. It handled several everyday jobs:
- Event registration
- Inquiries from prospective students
- Service requests sent to university offices
- Surveys
Form platforms like this tend to collect personal details such as names, email addresses and phone numbers. That is why the question of data exposure matters here. UTA has not said that any form data was accessed or taken. The university's statements describe "potentially unauthorized activity" and mention no data theft. Until the university says otherwise, readers should treat the scope of exposure as unknown, not as confirmed.
It is also worth separating the platform from the incident. UTA has not said that MachForms was how attackers got in. It has said only that MachForms is unavailable and that other systems are affected too. Taking a public-facing application offline while investigators work is a common containment step, and the outage alone says nothing about where the intrusion started.
Is this part of something bigger?
UTA itself raised the possibility. Its notice says the incident "appears to be part of a broader series of cybersecurity incidents affecting health systems and universities." The university did not name the other organizations, the threat actor or the techniques involved. None of the three sources reports any group claiming responsibility, a leak-site posting or a ransom demand. Any later claims of that kind should be treated as unverified until UTA confirms them.
The wording still matters. When a victim says its incident looks like part of a series, it usually means investigators see a pattern, whether that is shared tooling, timing or targeting. For other universities and health systems, that is a reason to check their own environments now instead of waiting for a fuller disclosure from Arlington.
What has UTA told its community to do?
UTA's guidance so far is short:
- Anyone who needs an alternative to MachForms for an urgent and significant operational need should contact the OIT Service Desk.
- Students and employees should report suspicious activity to the Information Security Office at [email protected].
- They were also told not to investigate the incident independently or circulate unverified information, and to rely on official updates.
- If action involving passwords, devices, systems or work practices becomes necessary, the university says it will give specific guidance through official channels.
The university has not asked anyone to reset passwords so far, and it has not issued any notice of exposed personal data.
What It Means for Defenders
Who is affected. UTA students, staff, prospective students and anyone who has submitted a UTA web form face the most direct impact for now: a service outage and an open question about their data. The university has published no fixed versions, patches or indicators of compromise, and it has not named a vulnerability. There is nothing specific to patch based on what is known.
If you are part of the UTA community:
- Follow the university's instructions. Send urgent requests through the OIT Service Desk and report anything suspicious to [email protected].
- Expect scammers to take advantage of the news. Be wary of unsolicited messages about "re-submitting" a form, confirming a registration or claiming a data-breach payout. Check them against the official UTA cybersecurity page before you click anything. This is general practice for high-profile outages; UTA has not reported any such phishing campaign.
- If you reused a password from a UTA-related account on other sites, consider changing it. This is a precaution, not something the university has asked for.
If you run IT or security at another university or health system:
- Take UTA's "broader series" statement as a signal to hunt for threats now. Review logs on internet-facing web applications, especially form builders and other third-party tools that collect public data, for unusual logins, new admin accounts or unexpected outbound traffic.
- Make a list of your public-facing form and survey platforms, including ones run by individual departments outside central IT, and make sure each one is patched, has multi-factor authentication on admin accounts, and has an owner who is responsible for it.
- Get in touch with your sector's information-sharing channels and law-enforcement contacts. If this is a coordinated campaign, indicators may reach those channels before they appear in public statements.
- Plan ahead for how you would communicate a similar outage. As of Nov. 3, The Shorthorn reported no new updates on UTA's cybersecurity page since the Oct. 29 notice, a reminder to keep a regular update cadence even when there is little new to say.
For CMMC-bound contractors and small businesses that work with universities: if you trade data with UTA through web forms or shared services, ask your institutional contact whether any of your submissions passed through affected systems, and keep a record of the answer in your incident-tracking files.
What we still don't know
As of publication, UTA has not disclosed:
- How the attackers got in, or whether MachForms was involved
- Which other webpages and IT systems are affected
- Whether any personal or institutional data was accessed or stolen
- Who is responsible
- When MachForms and the other systems will be restored
ZeroDayFeed will update this story when the university posts new information. For now, this is an unresolved incident with no confirmed data theft.
