University of Health Sciences and Pharmacy in St. Louis
April 1, 2023
•[ ransomware, education, healthcare ]
The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
Undisclosed North American medical research university
September 1, 2023
•[ espionage, malware, healthcare ]
In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
South Portland Public Schools
January 2, 2025
•[ hack, education ]
Jan. 6 South Portland Public Schools took down its internet network Sunday after a cyber breach threatened student data. The decision came after the school department's cyber security service detected a network break over the weekend. Director of technology Andy Wallace said in a letter to parents sent Monday morning that the decision was made to protect "student and other data." "We have been ...
University of Oklahoma
January 15, 2025
•[ ransomware, education ]
The University of Oklahoma says it is taking steps to address unusual cyber activity it discovered on its network. The Fog ransomware group claims responsibility for the attack.
Bennett College
October 27, 2025
•[ ransomware, education ]
Bennett College, a private HBCU for women in Greensboro, N.C., had network data accessed Oct. 27-Nov. 15, 2025, affecting 30,065 people. INC Ransom listed the college on its leak site Dec. 6; the college notified the state AG and offered credit monitoring.
Harvard University
November 18, 2025
•[ phishing, leak, education ]
Harvard disclosed that an unauthorized party accessed information systems used by its Alumni Affairs and Development office after a phone-based phishing attack. The compromised systems contained records used for alumni engagement and fundraising, including donation-related information, event attendance records, and contact details such as email addresses, telephone numbers, and home addresses. University communications indicated the systems did not generally contain Social Security numbers, passwords, or financial account numbers, but noted the institution was still investigating exactly what information was accessed and advised vigilance for suspicious communications purporting to be from the University.
Monmouth University
February 5, 2026
•[ ransomware, education ]
An unauthorized third party acquired files from Monmouth University's network between 5 and 13 February 2026; the university learned of the access on 3 March and later determined the affected data on 29 May. PEAR claimed responsibility on 26 March and alleged theft of 16 TB for extortion. Monmouth stated that there was no operational disruption and that university systems and programs continued operating normally. The initial access method was not disclosed.
Strategic Education, Inc.
February 23, 2026
•[ leak, education ]
An unauthorized actor accessed Strategic Education's computer servers between February 23 and February 25, 2026 and copied certain files. The company discovered the incident on May 21 and began notifying affected individuals on May 29. Regulatory filings in six states identify at least 190,155 affected residents, although Strategic Education did not disclose a confirmed nationwide total. The actor, access method, and motive were not identified.
Campbell University
March 31, 2026
•[ ransomware, education ]
An unauthorized party accessed one Campbell University cloud data-storage platform from March 31 to April 1, 2026. Campbell proactively took the platform offline and worked with its provider to restore it from backups; it stated that no other campus systems or data sources were affected. This was defensive containment, and no attacker-caused disruption was established. INC Ransom claimed the incident on April 11, and DataBreach.com's verified searchable dataset confirms the data compromise.
Global Schools Group (Global Schools Foundation)
April 1, 2026
•[ leak, misconfiguration, education ]
FulcrumSec reportedly accessed Global Schools Group's AWS environment in April 2026 using default or reused credentials and obtained data from 67 S3 buckets, five MSSQL servers, and four MongoDB servers. The group claimed to have stolen 4.8 TB and later released a 221 GB highlights archive following failed extortion negotiations. Global Schools Group confirmed a cybersecurity incident, said it had contained it and restored affected systems, and notified authorities, but did not verify FulcrumSec's figures or specific data claims. No operational disruption was reported.
Iowa State University
April 25, 2026
•[ leak, education, technology ]
Iowa State University student data (usernames, emails, enrollment info) was exposed in the ShinyHunters breach of vendor Instructure's Canvas platform, disclosed May 2026; ISU lost Canvas access on May 7 until the next morning amid the nationwide outage.
Pratiksha Foundation Charitable Trust
May 12, 2026
•[ ransomware, healthcare, education ]
By 2026-05-12, FulcrumSec had contacted Pratiksha Foundation Charitable Trust after compromising educational databases and demanded $750,000 to prevent disclosure. The compromised information included children's medical and mental-health details, travel and location information, and parental income data. The Bombay High Court issued an ex parte interim order on 2026-06-12 restraining FulcrumSec from publishing or disseminating the stolen information and directing service providers to block identifiers used by the group.
Clark County School District
May 22, 2026
•[ hack, phishing, financial ]
Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
Group GTI Limited (Oxford CareerConnect platform)
May 28, 2026
•[ hack, leak, technology ]
On May 28, 2026, third-party provider Group GTI informed the University of Oxford that an unauthorized party had accessed the CareerConnect platform through a security vulnerability. The intruder accessed user names, email addresses, and encrypted passwords for non-single-sign-on accounts. GTI patched the vulnerability and added security measures. Oxford's own systems and single-sign-on credentials were not compromised.
UEI College
May 29, 2026
•[ ransomware, leak, education ]
Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
R.I.C. Publications Pty Ltd
May 30, 2026
•[ leak, education, technology ]
On 2026-05-30, an unauthorized party used an automated email function associated with R.I.C. Publications' website to send an unauthorized message to customers. On 2026-06-04, the threat actor 2019 posted a file on a hacking forum and claimed it contained more than 116,000 customer purchasing records obtained from R.I.C. Publications without authorization. The published sample reportedly contained names, email addresses, telephone numbers, physical and IP addresses, order histories, and school affiliations. R.I.C. Publications confirmed the unauthorized email, secured the affected system, engaged cybersecurity specialists, and notified relevant authorities. The company said it had found no evidence of additional system compromise and that payment information was not affected; the claimed record count remained unverified.
Indian Institute of Technology Roorkee
June 2, 2026
•[ leak, misconfiguration, education ]
On June 2, 2026, cybersecurity researcher Rylen Anil discovered that a cloud-storage component supporting IIT Roorkees JEE Advanced results system allowed candidate files to be accessed without authentication. Anil downloaded a small number of files to verify the exposure and reported the issue, after which IIT Roorkee restricted access and said its logs showed no bulk download and access to less than 0.05% of the stored data.
States of Guernsey — Committee for Education, Sport & Culture
June 3, 2026
•[ social, phishing, government ]
On June 3, an attacker obtained unauthorized access to a Guernsey education employee email account and used it to send a malicious link. The mailbox remained accessible to the intruder for approximately one month and contained information relating to 74 individuals. Officials confirmed the breach but reported no evidence of data exfiltration beyond the Education IT environment. Criminal and Financial are limited inferences from the phishing/credential-abuse pattern; no extortion or political objective was established. Mixed reflects both unauthorized viewing of stored information and fraudulent use of the official mailbox.
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
University of Nottingham
June 9, 2026
•[ hack, leak, education ]
On 2026-06-09, the University of Nottingham detected unauthorized access to its Campus Solutions student-records system and took the affected system offline as a containment measure. The university confirmed that a significant amount of student and alumni data had been accessed. ShinyHunters claimed responsibility and published more than 40 GB of data. Have I Been Pwned identified approximately 455,000 unique email addresses in the leak. The university did not publicly attribute the intrusion.
