Nrt India
May 6, 2026
•[ ransomware, education ]
Nrt India was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-06. Sector: Professional Services. Country: India. Website: nrtindia.com. nrtindia.com zoominfo.com/c/nrt-india/372321597 NRT India is a premier IIT-JEE and NEET coaching institute headquartered in Lucknow, Uttar Pradesh, India. It was originally founded in 1997 by Shree Indu Shekhar Shukla under the name "NRT," and re-established on August 3031, 2010 by Sir A.N. Pandey, who previously served as Head of Department of Physics at the same institute. The institute now operates study centers in Lucknow, Barabanki, Dehradun, and Pratapgarh
Norcal Training Center
May 7, 2026
•[ ransomware, education ]
Norcal Training Center was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-07. Sector: Education. Country: United States of America. Website: www.norcaltc.org.
McCarthy
May 8, 2026
•[ ransomware, manufacturing, healthcare ]
McCarthy was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Professional Services. Country: United States of America. Website: mccarthyinc.com. mccarthyinc.com McCarthy, Inc., founded in 1955 and based in Savannah, Georgia, specializes in supplying metal doors and frames, wood doors, builder's hardware, toilet partitions, signage, louvers, and specialty accessories. The company serves diverse industries including healthcare, education, commercial, government, manufacturing, and hospitality sectors across the region. McCarthy provides comprehensive products and services from project inception through completion, focusing on building lasting relationships with project teams to ensure utmost client satisfaction.
Jozef Stefan Institute (IJS)
May 11, 2026
•[ ransomware, education, technology ]
Jozef Stefan Institute (IJS) was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Education. Country: Slovenia. Website: ijs.si. [AI generated] Jozef Stefan Institute (IJS) is Slovenia's leading research institution, headquartered in Ljubljana. It operates across multiple scientific disciplines including physics, chemistry, biochemistry, electronics, information technology, and environmental sciences. Founded in 1949, it conducts fundamental and applied research, hosts numerous national and international projects, and collaborates with academic and industrial partners. It also plays a key role in educating postgraduate researchers in Slovenia.
ice.org.uk
May 11, 2026
•[ ransomware, education ]
ice.org.uk was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: ice.org.uk. [AI generated] ICE, the Institution of Civil Engineers, is a UK-based professional membership organisation founded in 1818. It supports civil engineers worldwide through qualifications, knowledge sharing, policy influence, and professional development. Headquartered in London, it operates across infrastructure, construction, and engineering sectors. ICE sets industry standards, accredits engineering programmes, and advocates for sustainable infrastructure development globally.
Gorey Community School
May 13, 2026
•[ ransomware, education ]
Gorey Community School was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-05-13. Sector: Education. Country: Ireland. Website: goreycs.ie. Gorey Community School is a co-educational, multi-denominational institution located in Gorey, Co. Wexford, under the joint patronage of the Loreto Sisters and Waterford and Wexford ETB
Belz Institutions
May 13, 2026
•[ ransomware, education ]
Belz Institutions was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-13. Sector: Education. Country: Israel. Website: www.worldofbelz.org.
University Of Georgia
May 14, 2026
•[ ransomware, education, government ]
University Of Georgia was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-05-14. Sector: Education. Country: United States of America. Website: uga.edu. ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approximately 3.2 MB in raw text files. No customers were affected just exployees the following was stolen. - Physical Locations: Home addresses (like the Columbus, GA residential home) and specific office numbers (like Office 2207). - Private Contact Info: Personal cell phone numbers and home phone numbers (e.g., the 404-736-xxxx). - Employee Information: This often includes full names, contact details, and institutional identification photos. - Project Documentation: Information regarding internal university projects, including tracking logs and administrative data for various departments. - Workforce Data: Internal metadata such as position numbers, departmental assignments, and work schedules. - Technical Details: Notes regarding system maintenance and development that could potentially highlight internal processes - Critical Infrastructure: Active project maps for GEMA (Emergency Management), Georgia Broadband, and GDOT (Transportation) through 2026. - Government Records: Access to Asset Forfeiture logs and County-level GIS (Athens-Clarke, Bibb) that underpins 911 dispatch and land taxes. - Leadership Secrets: The UGA Office of the President Mail Tracker and Gov360 anonymous executive coaching logs. - The "SME" Map: we have identified the "Subject Matter Experts" like Noah Abouhamdan, Chad Rupert, and Pat Russell. we know exactly how many hundreds of hours these people have spent on specific pieces of code. - Security Clearances: we know who is a "Benefited" full-time employee (high-value target) versus a "Student Assistant" (low-value entry point).
Stride Learning
May 14, 2026
•[ ransomware, education ]
Stride Learning was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-05-14. Sector: Education. Country: United States of America. Website: stridelearning.com. Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's not that hard. This is a warning to all companies that if you don't pay it will get leaked. If you pay you have are word that it's deleted also with a picture before and after. If you want we will also take a video.
PowerCampus
May 14, 2026
•[ ransomware, education, technology ]
PowerCampus was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-05-14. Sector: Education. Country: India. Website: powercampus.in. Cloud-based school management and collaboration platform targeting educational institutes in India, covering online fee payments, exam management, online admissions, teacher-parent communication, and e-learning continuity.
McCarthy Inc
May 15, 2026
•[ ransomware, manufacturing, healthcare ]
McCarthy Inc was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-05-15. Sector: Manufacturing. Country: United States of America. Website: mccarthyinc.com. McCarthy, Inc., based in Savannah, Georgia, has been providing quality doors, frames, hardware, and related products since 1955. The company specializes in metal and wood doors, including architectural-grade flush doors and custom stile and rail units, along with a variety of specialty items. McCarthy, Inc. offers comprehensive services from project inception to completion, aiming to build lasting relationships with clients across various industries such as healthcare, education, and hospitality. Their commitment to customer satisfaction is reflected in their extensive product offerings and dedicated service.
Tower View Primary School
May 15, 2026
•[ ransomware, education ]
Tower View Primary School was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-05-15. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: towerview.staffs.sch.uk. Tower View Primary School Tower View Primary School is an educational institution that serves approximately 380 pupils across 14 classes.
Don Bosco Technical Institute of Makati
May 17, 2026
•[ ransomware, education ]
Don Bosco Technical Institute of Makati was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-17. Sector: Education. Country: Philippines. Don Bosco Technical Institute of Makati is dedicated to providing quality education and holistic formation for students from elementary to senior high school, as well as technical vocational education. The institution aims to develop competent, service-oriented individuals who embody the values of the Salesian educational system. It primarily serves underprivileged youth, equipping them with the necessary skills and competencies for better employment opportunities. The school emphasizes a curriculum that integrates academic excellence with spiritual and moral development.
bergen1.net
March 29, 2026
•[ ransomware, education ]
bergen1.net was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-03-29. Country: United States of America. Website: bergen1.net. Founded in 1965, Bergen Community College is a comprehensive higher education institute that offers academic degree programs to students. Bergen Community College is located out of Paramus, New Jersey
We will publish all the data(1TB) in a week
University of Finance and Administration
May 18, 2026
•[ ransomware, education, finance ]
University of Finance and Administration was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-18. Sector: Education. Country: Czechia. Website: vsfs.cz. vsfs.cz rocketreach.co/university-of-finance-and-administration-prague-profile_b5c5d93ff42e0e40 University of Finance and Administration is a prestigious private university in Prague, founded in 1999 and recognized as one of the Czech Republic's first private business schools. With campuses in Prague, Karlovy Vary, and Most, it offers modern bachelor's, master's, and doctoral programs in economics, finance, law, marketing, and IT taught in Czech, English, and Russian. Combining academic excellence with practical focus, VFS empowers over 5,000 students through flexible study formats, international partnerships, and strong industry connections
University of Valencia
May 23, 2026
•[ ransomware, education, leak ]
University of Valencia was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-23. Sector: Education. Country: Spain. Website: uv.es. University of Valencia is a university located in the Spanish city of Valencia. It is one of the oldest surviving universities in Spain, and the oldest in the Valencian Community, and is regarded as one of Spain's leading academic institutions. The University was founded in 1499, and currently has around 55,000 students. Most of the courses are given through the medium of Spanish, but the university has promised to increase the amount of courses available in Valencian. Moreover, in some degrees part of the teaching is in English - we don't know why you save personal kids photos and students on the server, the data is very sensitive and Embarrassing for the students and the staffs and kids, we will discuss the status with our Management Team about the kids photos, Contact us for deal - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
Prologic Construction
May 24, 2026
•[ ransomware, manufacturing, healthcare ]
Prologic Construction was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-24. Sector: Manufacturing. Country: Canada. Website: prologicconstruction.ca. Prologic Construction is a trusted general contractor based in Alberta, specializing in high-quality construction solutions for both public and private sectors since 1999. The company offers a full range of services including commercial, institutional, and municipal projects, ensuring timely completion and adherence to budget. With a commitment to quality craftsmanship and competitive pricing, Prologic Construction has built a strong reputation for reliability and expertise. Their portfolio includes various projects such as school modernizations, arena renovations, and healthcare facilities, reflecting their dedication to excellence and community development
ctps.tp.edu.tw
May 23, 2026
•[ ransomware, education ]
ctps.tp.edu.tw was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-05-23. Sector: Education. Country: Taiwan. Website: ctps.tp.edu.tw. ctps.tp.edu.tw Taiwanese Public Elementary School
ctps.tp.edu.tw is the official website of ...
My English House academy
May 27, 2026
•[ ransomware, education ]
My English House academy was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Education. Country: Spain. Website: myenglishhouseacademy.com. myenglishhouseacademy.com is the website for My English House, a network of English academies operating across Spain, The business behind the website is a language school chain specializing in teaching English, with over 30 locations across Spain. It was founded by Carlos Barber and Arturo Mateu. The network operates under a franchise model, offering franchise opportunities to entrepreneurs. The company's approach is based on a proprietary "learning by doing" methodology that was developed in-house. - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
gokids gokidspublishing.com dev.redpilotstudio.com gokidsmobile.com
May 28, 2026
•[ ransomware, technology, education ]
gokids gokidspublishing.com dev.redpilotstudio.com gokidsmobile.com was listed as a victim on the leak site of the 0day Syndicate ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Technology. Website: gokids.kids. GoKids is a brand that creates educational mobile apps, games, and content for toddlers (ages 2-5)
