Research Foundation of The City University of New York
October 20, 2026
•[ ransomware, education ]
Research Foundation of The City University of New York was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-20. Sector: Education. Country: United States of America. Website: www.rfcuny.org. Education Administration Programs Stolen data: 295 GB.
Medienwerkstatt
October 22, 2026
•[ ransomware, leak, education ]
Medienwerkstatt was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Education. Country: Germany. Medienwerkstatt stands for digital and printed communication of the highest quality and disting
uishes itself through an exceptional customer service. With more than 50 passionate talents for
various offline and online disciplines, medienwerkstatt ag is one of the largest media service
providers in the canton of Thurgau.
We will upload 130gb of corporate data soon. Employee personal information (names, addresses, p
hones, contacts and so on), customer information, contracts and agreements, and so on.
dorsiacademy.it
October 23, 2026
•[ ransomware, education ]
dorsiacademy.it was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Education. Country: Italy. Website: dorsiacademy.it. ART SCHOOL: Dove la Creativit Prende Forma Benvenuti in Art School, il luogo dove il talento incon...
Burnaby Schools - School District 41
October 26, 2026
•[ ransomware, education ]
Burnaby Schools - School District 41 was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Education. Country: Canada. Website: www.burnabyschools.ca.
University of New Mexico
October 26, 2026
•[ ransomware, hack, education ]
University of New Mexico was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Education. Country: United States of America. 36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
Telecom Egypt
October 18, 2026
•[ ransomware, technology, education ]
Telecom Egypt was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-18. Sector: Technology. Country: Egypt. Website: te.eg. computer training academy Egypt | Course materials and programming projects; Exam preparation materials; Student account folders and work; A complete copy of the course database | [NOT PAID EXPOSED]
Weld Re 8 School District
October 21, 2026
•[ ransomware, education ]
Weld Re 8 School District was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Education. Country: United States of America. Website: weld8.org. weld8.org Weld Re-8 School District public school district founded in 1914 in Fort Lupton, Colorado, serving about 2500 students across 7 schools with a 43.5 million dollar budget. The student body is 76 percent minority with over half on free lunch, and academics are weak, math proficiency 16 to 19 percent, reading 22 to 26 percent, far below state averages. The core problem is teacher pay, starting salaries 47500 dollars versus 53000 to 64500 nearby, driving 23 percent yearly turnover. Voters rejected four tax requests since 2023, and on November 3 2026 they vote Issue 5C, a 4.9 million dollar tax hike, or face 1.3 million in mid-year cuts. New superintendent Dr. Justin Ralston launched a 2026 to 2029 plan reviving agriculture and adding IT and cybersecurity tracks. Oil and gas covers over half the local tax base.
MediSolution
October 27, 2026
•[ ransomware, healthcare, technology ]
MediSolution was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Healthcare. [AI generated] MediSolution was a Canadian software company based in Montreal, Quebec, specializing in enterprise resource planning and management software solutions for the public sector, including healthcare, local government, and education institutions. It provided financial management, human resources, and payroll software systems. The company operated in the enterprise software and information technology industry before being acquired and integrated into Harris Computer Systems.
Seminole Schools
October 19, 2026
•[ ransomware, education ]
Seminole Schools was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Education. Country: United States of America. Website: sps.k12.ok.us. NameCompany: Seminole Schools |
Domain: internal.seminole.org |
Country: Seminole,Florida,US |
Website: sps.k12.ok.us |
Revenue: $15.5 Million |
Industry: Education General, Education |
Employees: 50-100 |
Properties: 39.6 GB (54,468 Files, 5,495 Folders)
Coastal Alabama Community College
October 21, 2026
•[ ransomware, education, financial ]
Coastal Alabama Community College was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Education. Country: United States of America. Website: coastalalabama.edu. Coastal Alabama Community College demonstrates an extreme disregard for its own security and the security of its students and makes no attempt to address these deficiencies. Therefore, we are publishing their sensitive information, such as student education records, protected health information, financial aid and loan information, employee personnel files, Social Security numbers, and payment card data. They are also known for their incidents, and we are making this information publicly available to you. As a result, they violate laws such as HIPAA, FERPA, GLBA, and PCI DSS.
Llano Independent School District
October 18, 2026
•[ ransomware, education ]
Llano Independent School District was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-18. Sector: Education. Country: United States of America. Website: www.llanoisd.org.
American Campus
October 19, 2026
•[ ransomware, education ]
American Campus was listed as a victim on the leak site of the Helix ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Education. Country: United States of America. American Campus records. Yearly revenue ~$1 billion yearly. GoFile links and passwords unlock in 6 hours.
Morrow Meadows Corporation
September 23, 2026
•[ ransomware, manufacturing, technology ]
Morrow Meadows Corporation was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Other. Country: United States of America. Website: morrow-meadows.com. [AI generated] Morrow Meadows Corporation is a United States-based electrical contracting company. It provides electrical construction, design-build, and engineering services for commercial, industrial, institutional, and data center projects. Operating primarily in California, the company serves sectors such as technology, healthcare, education, and manufacturing, offering services including power distribution, lighting, fire alarm systems, and electrical infrastructure installation.
Hudson River Museum
October 27, 2026
•[ ransomware, education ]
Hudson River Museum was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Education. Country: United States of America. Website: www.hrm.org. Museums, Historical Sites, and Zoos Stolen data: 115 GB.
UPDATE: UNM
October 27, 2026
•[ ransomware, education, healthcare ]
UPDATE: UNM was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Education. We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way.
The Anglican International School
October 28, 2026
•[ ransomware, education ]
The Anglican International School was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Education. Country: Israel. Website: aisj.co.il. Country: Grenada.Spain |
Website: aisj.co.il |
Revenue: $11.1 Million |
Industry: Primary and Secondary Education |
Employees: 50-100 |
Properties: 218 GB (257,960 Files, 28,378 Folders)
RCOA- Regent Christian Online Academy
October 27, 2026
•[ ransomware, education ]
RCOA- Regent Christian Online Academy was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Education. Country: Canada. Website: www.rcoa.ca. Hospitals and Health Care Stolen data: 1 GB.
California School Boards Association
October 29, 2026
•[ ransomware, education ]
California School Boards Association was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Education. Country: United States of America. Website: www.csba.org. Education Management Stolen data: 80 GB.
Eichstatt
October 27, 2026
•[ ransomware, government, education ]
Eichstatt was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-27. Country: Germany. Website: eichstaett.de. eichstaett.de 1,5 tb information Eichsttt is a small historic town in Upper Bavaria with 13,500 inhabitants and 1400 years of history, famous for its baroque architecture, Jura Museum with Archaeopteryx fossils and UNESCO Altmhltal Geopark. The Katholische Universitt Eichsttt-Ingolstadt enrolls about 4,800 students across 4 faculties spanning theology, philosophy, languages and business in Ingolstadt. Under President Dr. Klaus Stwe since 2023, it received 5.86 million euro in Bavarian funding for digital transformation and AI programs. It is developing an international campus in Shandong, China and launching new sustainability master's degrees. Key strengths are its Catholic identity, small class sizes and strategic location between Munich and Nuremberg.
Phoenix Charter Academy
October 31, 2026
•[ ransomware, education, financial ]
Phoenix Charter Academy was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: United States of America. Website: phoenixcharteracademy.org. Phoenix Charter Academy Phoenix Charter Academy Network is a public charter school network in Massachusetts, USA, operating three campuses (Chelsea, Lawrence, Springfield) and serving mainly low-income and immigrant families.36,829 files, 445.1 GB of data.Domain controller (password hashes of ~170+ staff accounts)File server, helpdesk server, print serverPowerSchool test server the student databaseStudent special-education records of named minors: signed IEP/504 plans for the 20252026 school year, BASC-3 psychological protocols, three-year re-evaluations, speech-therapy files, discipline recordsImmigration records of students' families: official CBP I-94 entry records, parole application statements, immigration cover lettersStaff personal and financial data: W-2 forms with SSNs and salaries, US passport card and foreign passport scans, bank statements with account numbers (Bank of America / Tremont Credit Union), signed direct deposit authorizations, CORI background-check filesMedical data: MassHealth cards and applications, immunization recordsMunicipal compliance files: Lawrence Board of Health licenses and inspections (20222024), Fire Department inspection certificatesInternal HR material: network-wide salary bands More
