Kozminski University
June 15, 2026
•[ ransomware, education, finance ]
Kozminski University was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: Poland. Website: kozminski.edu.pl. ***.edu.pl zoominfo.com/c/kozminski-university/372606592 Kozminski University, located in Warsaw, is Poland's premier private business school and a globally recognized academic institution holding the prestigious "Triple Crown" accreditation. Consistently ranked among the top European business schools by the Financial Times, it specializes in management, finance, and law. The university is dedicated to shaping future business leaders through innovative, research-driven education and strong international partnership
glendale.edu
June 15, 2026
•[ ransomware, education, leak ]
glendale.edu was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: United States of America. Website: glendale.edu. Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and admission processing), including 150,000+ student records with names, dates of birth, and @student.glendale.edu emails, login and enrollment mapping files, new student enrollment CSVs, immunization compliance logs, admission checklist reports, financial aid batch exports, and transcript PDFs spanning September 2020 through June 2026. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK
moody.edu
June 15, 2026
•[ ransomware, education, technology ]
moody.edu was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: United States of America. Website: moody.edu. Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communications systems (MBI, EDC/Salesforce leads, PeopleSoft PS_COMMUNICATION, Horizon SIS, WHPD donor database, and Cadence admissions), including 46 million communication records, 2.2 million enrollment lead records, 108,000 biodemographic master files with addresses and birthdates, 3.3 gigabytes of donor gift data, employee payroll XML with home addresses and earnings, 1,100+ admissions outreach files, and student housing assignment records. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK
utb.edu.vn
May 15, 2026
•[ ransomware, education ]
utb.edu.vn was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-05-15. Sector: Education. Country: Vietnam. Website: utb.edu.vn. The school's mission is to train human resources at the undergraduate and postgraduate levels;...
greyhighschool.com
May 15, 2026
•[ ransomware, education ]
greyhighschool.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-05-15. Sector: Education. Country: United States of America. Website: greyhighschool.com. Grey remains as one of the leading schools in the country, with a culture and value system that supp...
Wall ISD
June 21, 2026
•[ ransomware, education ]
Wall ISD was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-06-21. Sector: Education. Country: United States of America. Website: www.wallisd.net. Wall ISD is an educational institution that serves students in the Wall, Texas area, providing a range of programs and activities for elementary, middle, and high school students. The district emphasizes inclusivity and equal access to education, ensuring that all students, regardless of their background, have the opportunity to participate in school activities. Wall ISD is committed to fostering a supportive learning environment and offers resources for both new and returning students. The intended clients are students and their families within the Wall community.
bits-pilani.ac.in
June 20, 2026
•[ ransomware, education, leak ]
bits-pilani.ac.in was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-06-20. Sector: Education. Country: India. Website: bits-pilani.ac.in. BITS Pilani is a premier Indian private research university and "Institution of Eminence" known for elite engineering and science programs across five campuses. Founded in 1964, it is highly selective with a 1.47% acceptance rate and offers a 0% attendance policy with mandatory industry immersion.
sansilvestre.edu.pe
June 25, 2026
•[ ransomware, education ]
sansilvestre.edu.pe was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-06-25. Sector: Education. Country: Peru. Website: sansilvestre.edu.pe. San Silvestre School (Asociacin Civil) is one of Peru's most prestigious private all-girls British schools, founded in...
acemacon.org
June 28, 2026
•[ ransomware, education ]
acemacon.org was listed as a victim on the leak site of the threeam ransomware group; the attack is estimated to have taken place on 2026-06-28. Country: Mexico. Website: acemacon.org. The Academy for Classical Education is dedicated to fostering knowledge and critical thinking skills in children, preparing them to be independent learners for life. It offers a comprehensive educational experience that includes fine arts, athleti
Driving School Software
May 21, 2026
•[ ransomware, education, financial ]
Driving School Software was listed as a victim on the leak site of the PrinzEugen ransomware group; the attack is estimated to have taken place on 2026-05-21. Sector: Education. Hundreds of driving schools impacted.
16 Million rows of SQL, 8000 FULL credit cards, and more.
Full leak post + data available on the new PRINZ EUGEN site.
prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion
Official Statement: Protecting palatineschool.org Infrastructure
June 28, 2026
•[ ransomware, education, misconfiguration ]
Official Statement: Protecting palatineschool.org Infrastructure was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-28. Sector: Education. During our routine network security audits, our team discovered critical structural vulnerabilities within Palatine School, which granted us full, unrestricted access to their central server (PALDC2020). We had the technical capacity to access every directory, including pupil databases ( StudentData NHS NO ) , Pupil Admin - Users -FocusIT) and staff records Personnel.We want to announce that we have locked down this operation and decided to leak absolutely nothing.This is an institution dedicated to children and special needs education. Unlike corporate thieves or ruthless threat actors, we operate with a strict code of ethics: we do not target children, schools, or healthcare facilities.Instead of destroying them, we have chosen to act as an uninvited security audit. We are using our platform to publicly invite the administration of Palatine School to contact us privately. We will provide them with the full technical details of the critical vulnerabilities we discovered and guide them on how to patch their system for free, ensuring they are protected from other ruthless cyber criminals.
Lørenskog kommune
June 29, 2026
•[ ransomware, government, healthcare ]
Lrenskog kommune was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-06-29. Sector: Government & Defense. Country: Norway. Website: lorenskog.kommune.no. Lrenskog kommune offers a range of services including education, health care, social services, and community development. Their intended clients include residents seeking information on property tax, childcare, and various cultural and recreational activities. The municipality also engages with the public through political meetings and community involvement initiatives. Additionally, Lrenskog kommune celebrates local events and milestones, fostering a sense of community among its residents.
Musashino University
June 29, 2026
•[ ransomware, education ]
Musashino University was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-29. Sector: Education. Country: Japan. Website: www.musashino-u.ac.jp.
Sociedad Latina
June 25, 2026
•[ ransomware, education ]
Sociedad Latina was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-06-25. Sector: Other. Country: United States of America. Website: sociedadlatina.org. Support in education, civic engagement, workforce development, and arts and culture, specifically tailored for multilingual learners
Instructure Holdings, Inc. (Canva LMS, instructure.com)
May 3, 2026
•[ ransomware, education, technology ]
Instructure Holdings, Inc. (Canva LMS, instructure.com) was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-05-03. Sector: Education. Country: United States of America. Website: instructure.com. Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved. Pay or Leak. This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Size: 3.65TB+ (uncompressed) | Updated: 3 May 2026 | Warning: FINAL WARNING PAY OR LEAK
childplace.org
April 17, 2026
•[ ransomware, education ]
childplace.org was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-17. Sector: Education. Country: United States of America. Website: childplace.org. Childplace Family Services is dedicated to nurturing children and empowering families through a range of services including fostering, adoption, counseling, and community support. The organization aims to serve children and families at risk, particularly those who have experienced abandonment, abuse, or neglect. With a history of over 50 years, Childplace has successfully helped thousands of children find loving homes and provided essential support to families in need. Their mission is rooted in promoting hope and healing within the community, guided by a spirit of Christian love.
Employees: 100
Revenue: $7.2 Million
Industry: Non-Profit & Charitable Organizations
Phone Number: (812) 282-8248
Cazh.id
May 5, 2026
•[ ransomware, finance, technology ]
Cazh.id was listed as a victim on the leak site of the Icarus ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Financial Services. Country: Indonesia. Website: bkdp.cazh.id. - User DB: 300,000 Users (Email, Hash, Phone, Address, DOB) for https://bkdp.cazh.id/.
- KYC Vault: 7,800 Government IDs + 4,200 Selfies (including "Hold-to-Face" ID selfies).
- 34 SQL Databases for associated schools (Students/Parents/Staff).
- Corporate/Financial: Full Investor Database + partner documents
- Collateral documents (Vehicle Registration Documents & Property Deeds)
- Billing Proofs
- Full src code of their services
Data stolen: PII, SOURCE CODE, KYC
Colegio María Inmaculada (CMI)
May 5, 2026
•[ ransomware, education ]
Colegio Mara Inmaculada (CMI) was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Education. Country: Costa Rica. Website: mariainmaculada.ed.cr. Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2.
Académie de Montpellier / CSJM
May 5, 2026
•[ ransomware, education, government ]
Acadmie de Montpellier / CSJM was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Education. Country: France. Website: ac-montpellier.fr. French public school network. Domain CSJM.BEZIERS, part of Acadmie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff credentials.
Beaconhouse School System
April 27, 2026
•[ ransomware, leak, education ]
Beaconhouse School System was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Education. Country: Pakistan. Website: beaconhouse.net. beaconhouse.net zoominfo.com/c/beaconhouse-school-system/351460008 Beaconhouse was founded in November 1975 in Lahore, Pakistan, as the modest Les Anges Montessori Academy with just 19 toddlers. Today it has grown into a global network with over 380,000 students across 8 countries, including Pakistan, the UK, Malaysia, the Philippines, UAE, Oman, Belgium, and Thailand. The group employs more than 18,000 staff from around the world and encompasses everything from early childhood education to university-level institutions such as Beaconhouse National University and Concordia Colleges. In 1996, it became the first private school network in the world to receive financing from the World Bank's International Finance Corporation
