District of Columbia Public Schools
July 26, 2026
•[ ransomware, education, government ]
District of Columbia Public Schools was listed as a victim on the leak site of the ExfilSquad ransomware group; the attack is estimated to have taken place on 2026-07-26. Sector: Education. Country: United States of America. Website: dcps.dc.gov. [AI generated] District of Columbia Public Schools (DCPS) is a public school district serving Washington, D.C., USA. It operates as the primary government-run K-12 educational system for the nation's capital, overseeing dozens of schools, thousands of students, and a large workforce of educators and administrators. DCPS falls under the education sector and is governed by the D.C. government, focusing on curriculum development, student achievement, and community engagement.
Newcastle University
July 26, 2026
•[ ransomware, education ]
Newcastle University was listed as a victim on the leak site of the ExfilSquad ransomware group; the attack is estimated to have taken place on 2026-07-26. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: ncl.ac.uk. DATA SUMMARY:
440K~ records containing: applicant and student contact information, significant PII, and admissions data.
Universitatea de Vest „Vasile Goldiș” din Arad
July 26, 2026
•[ ransomware, education ]
Universitatea de Vest Vasile Goldi din Arad was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-07-26. Sector: Education. Country: Romania. Website: www.uvvg.ro.
braywoodschool.co.uk
July 27, 2026
•[ ransomware, education ]
braywoodschool.co.uk was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: braywoodschool.co.uk. Founded in 1858, the school has more than 165 years of educational history and serves children from early years through
landesmuseum.de
July 27, 2026
•[ ransomware, education ]
landesmuseum.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Education. Country: Germany. Website: landesmuseum.de. Established in 1919, the museum preserves and presents more than 50,000 years of human cultural history, ranging from prehistoric artifacts
Rondout Electric
July 30, 2026
•[ ransomware, energy, healthcare ]
Rondout Electric was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-07-30. Sector: Energy & Utilities. Country: United States of America. Website: www.rondoutelectric.net. Rondout Electric Inc. is a leading electrical contracting company with over 50 years of experience, specializing in a wide range of projects including health care facilities, schools, industrial complexes, and public sector projects. With a dedicated team of approximately 100 employees, they are known for their disciplined approach to ensuring projects are completed safely, on time, and within budget. The company has built long-standing relationships with clients who appreciate their commitment to integrity and customer satisfaction. Based in Highland, NY, Rondout Electric serves clients across the eastern part of New York State.
School Facility Consultants
June 1, 2026
•[ ransomware, education, government ]
School Facility Consultants was listed as a victim on the leak site of the abyss ransomware group; the attack is estimated to have taken place on 2026-06-01. Sector: Professional Services. School Facility Consultants (SFC) is a full-service company that provides expert guidance in school facility planning and funding for School Districts, County Offices of Education, and Charter Schools across California.
katholiekamersfoort.nl
June 2, 2026
•[ ransomware, leak, education ]
katholiekamersfoort.nl was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Education. Country: Netherlands. Website: katholiekamersfoort.nl. The church website's network (katholiekamersfoort.nl/) has been breached, resulting in the exfiltration of over 10 GB of data. This data pertains to donors, staff, and the personal information of a large number of individuals. The compromised data includes: Databases and Personally Identifiable Information (PII), internal network shares and document, contact lists, board and committee data, as well as system metadata.
Lead Company (Leadership Boulevard)
June 3, 2026
•[ ransomware, education, leak ]
Lead Company (Leadership Boulevard) was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-06-03. Sector: Professional Services. Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected: The specific schools explicitly named in the exfiltrated folders include: - Arya Vidyapith - Aakarsh International Public School - Students High School - Rainbow International Matric Hr. Sec. School - Vignan Private School The following info was stolen: 1. Personally Identifiable Information (PII) of Students - Full Names and Demographics: Complete names of children sorted by gender and admission numbers. - Academic Progression: Exact tracking of student grade levels (e.g., SKG, Class 1, Class 2) and division assignments - Age and Vital Records: Exact dates of birth (DOB) for all enrolled students. - Physical Locations: Full residential addresses, cities/districts (such as Nampally, Telangana), and exact localized postal pincodes 2. Guardian and Parent Contact Registries - Parent Identity: Full names of both fathers and mothers linked directly to their children. - Direct Contact Methods: Active personal mobile numbers for parents, creating a severe vulnerability for automated spam or voice-phishing attacks. - Digital Contact: Parent email addresses intended for formal school updates. - Student Led Events - Teacher Certificates - gac-reports - Assessments 3. Proprietary LEAD School Academic Metrics - ELGA Placement Data: Internal academic tracking metrics, showing specific curriculum tiers like "ELGA Class" (e.g., ELGA02, ELGA06) and "ELGA Division" for individual students. - Classroom Analytics: Operational performance data exfiltrated directly from the nucleus.leadschool.in administrative portal. - Teacher Resources: Lesson plans, training modules, and classroom resources that form the core commercial assets of the LEAD platform.
SeeWriteHear
June 3, 2026
•[ ransomware, technology, education ]
SeeWriteHear was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-06-03. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.seewritehear.com. SeeWriteHear specializes in providing print and digital accessibility solutions, including Braille, large print, and web accessibility services. Their offerings cater to various industries such as education, government, and publishing, ensuring compliance with usability standards. The company focuses on innovative technology to enhance accessibility for individuals with disabilities. With a commitment to information equality, SeeWriteHear serves clients by creating accessible content and providing consulting and training services.
Universitas Nasional
June 6, 2026
•[ ransomware, education ]
Universitas Nasional was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-06. Sector: Education. Country: Indonesia. Website: unas.ac.id. Universitas Nasional (UNAS) is an educational institution that offers a wide range of academic programs, including undergraduate and postgraduate degrees across various faculties such as Social Sciences, Law, Economics, and Health Sciences. The university aims to provide quality education and has implemented a robust internal quality assurance system. UNAS serves students from diverse backgrounds, including those pursuing regular and recognition of prior learning (RPL) pathways. Additionally, the university engages in research, community service, and hosts international conferences to enhance academic collaboration - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
Institucion Cervantes
June 8, 2026
•[ ransomware, education ]
Institucion Cervantes was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-06-08. Sector: Education. Country: Argentina. Website: cervantes.edu.ar. ***.edu.ar zoominfo.com/c/institucion-cervantes/372383480 nstitucion Cervantes is a private higher education institution based in Crdoba, Argentina, with over 60 years of history and more than 3,000 students. The school specializes in short-term, future-oriented careers ranging from one to three years, focusing on practical fields like Business Administration, Data Science, IT, and Law. It is highly recognized in the region for its strong commitment to student development and rapid professional integration into the job market
GRIP Outreach For Youth
May 28, 2026
•[ ransomware, education ]
GRIP Outreach For Youth was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Education. Country: United States of America. Website: www.gripyouth.com. - Financial & Accounting Records- Sensitive Employee- Youth Participant & Child Protection Records- Governance & Legal Documents
Kinetic Education
June 8, 2026
•[ ransomware, education ]
Kinetic Education was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-08. Sector: Education. Country: Australia. Website: www.kineticeducation.com.au.
nottingham.ac.uk
June 9, 2026
•[ ransomware, leak, education ]
nottingham.ac.uk was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-09. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: nottingham.ac.uk. Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the University of Nottingham and its Malaysia and China campuses was compromised, including payer contact information, transaction amounts, IP addresses, full names, home addresses, postcodes, email addresses, phone numbers, dates of birth, and other internal campus data. | Size: 19GB+ (compressed) | Updated: 10 June 2026 | SHA256: d3aaaf06dd857deec3866072cc2876780623d880992e8d735094db4779535873
Global Schools Foundation
June 10, 2026
•[ ransomware, education ]
Global Schools Foundation was listed as a victim on the leak site of the fulcrumsec ransomware group; the attack is estimated to have taken place on 2026-06-10. Sector: Education. Country: Singapore. [AI generated] Global Schools Foundation is a Singapore-based non-profit organization operating in the international education sector. It manages a network of private schools across Asia and the Middle East under brands such as Global Indian International School. The foundation focuses on providing quality education with an Indian curriculum framework to students from diverse nationalities, emphasizing holistic development and academic excellence across multiple campuses worldwide.
delano.k12.mn.us
June 9, 2026
•[ ransomware, education ]
delano.k12.mn.us was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-06-09. Sector: Education. Country: United States of America. Website: delano.k12.mn.us. Delano Public Schools is dedicated to providing systemic growth toward educational excellence for ev...
shottermill-jun.surrey.sch.uk
May 17, 2026
•[ ransomware, education ]
shottermill-jun.surrey.sch.uk was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-05-17. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: shottermill-jun.surrey.sch.uk. Shottermill Junior School Shottermill Junior School is a primary educational institution located in...
santoinacio-rio.com.br
May 1, 2026
•[ ransomware, education ]
santoinacio-rio.com.br was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Professional Services. Country: Brazil. Website: santoinacio-rio.com.br. Colgio Santo Incio, part of the Jesuit Education Network, has been providing quality education sin...
UiTM Holdings
June 10, 2026
•[ ransomware, education, healthcare ]
UiTM Holdings was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-06-10. Sector: Education. Country: Malaysia. Website: uitmholdings.com. ***.com zoominfo.com/c/ui-holdings-sdn-bhd/390203835 UiTM Holdings is the investment holding arm of Universiti Teknologi MARA (UiTM), Malaysias largest university. It commercialises the universitys assets and expertise across property, healthcare, education, and technology. Its primary mission is to generate sustainable revenue to support UiTMs academic and research programmes
