University of Texas at San Antonio
August 15, 2026
•[ hack, education ]
UT San Antonio detected unauthorized activity against university technology systems at the edge of its academic-campus network during the weekend of August 15-16, 2026. The university contained the activity before it reached core systems and found no evidence that university data was accessed or exfiltrated. UTSA proactively took systems and services offline, disrupting phones, email, connectivity and other technology-dependent services and delaying the start of fall classes until August 24.
Arizona State University
August 17, 2026
•[ ransomware, leak, education ]
Arizona State University, a public research university in Tempe, was listed on the Direwolf ransomware group's leak site on Aug 17, 2026, claiming stolen university files; about 1.08 million records were later indexed. ASU has not publicly confirmed the breach.
Cambrian High School & College
August 19, 2026
•[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
Springfield Public Schools
September 1, 2026
•[ ransomware, education ]
Springfield Public Schools (Massachusetts) detected malicious traffic Sept. 1, 2026; its network crashed and schools closed for about a week. The FBI said student and staff data was made public; Interlock claimed the attack. District offered staff credit monitoring.
St James' Anglican School
September 15, 2026
•[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
Kendall Hunt Publishing Company
September 18, 2026
•[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
United Federation of Teachers
September 18, 2026
•[ ransomware, education ]
The United Federation of Teachers, New York City's teachers' union, was listed by extortion group N0n on Sept. 18, 2026, claiming theft of ~181,420 legal case documents and demanding negotiation before publication. UFT has not confirmed the breach.
Ludwig-Maximilians-Universität München
September 19, 2026
•[ hack, leak, education ]
LMU Munich, Germany, disclosed in Sept 2026 that an unauthorized actor accessed student-registration master data in a university IT system and that the data must be assumed to have been retrieved. Modification was prevented; the Bavarian State Criminal Police is investigating.
Burnaby School District 41
September 21, 2026
•[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
Michigan State University
November 1, 2026
•[ ransomware, education ]
Michigan State University was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Education. Country: United States of America. Full Personal Identifiable Information for 1.03 million current and ex students as well as the full team in relations to MSU, we also have current and ex passwords, as well as a full compromise towards your System, don't let it scale any further, you've been given the chance to the make the right choice. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
University of Illinois Chicago
October 2, 2026
•[ ransomware, education ]
University of Illinois Chicago was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Education. Country: United States of America. Website: www.uic.edu. Higher Education Stolen data: 344 GB.
ENKA Schools
October 5, 2026
•[ ransomware, education ]
ENKA Schools was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Education. Country: Turkey. Website: enka.k12.tr. Status: upcoming | Deadline: 2026-10-15T00:00:00Z
Slate Valley Unified School District
October 1, 2026
•[ ransomware, education ]
Slate Valley Unified School District was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Education. Country: United States of America. Website: slatevalleyunified.org. The Slate Valley Unified Union School District is a public school district located in Fair Haven, Vermont, serving the communities of Benson, Castleton, Fair Haven, Hubbardton, Orwell, and West Haven. The data also includes 647 GB of SQL databases containing personal and medical information about students and employees.
Champaign Unit 4 School District
September 5, 2026
•[ ransomware, education ]
Champaign Unit 4 School District was listed as a victim on the leak site of the VYPR ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Education. Country: United States of America. Website: www.champaignschools.org. Champaign Unit 4 School District is dedicated to empowering each learner to thrive in a diverse and changing world. The district offers a positive and supportive school culture, focusing on safe and dynamic learning environments. It provides exceptional learning opportunities and communicates essential information to community stakeholders. The intended clients are students and their families within the Champaign area.
Beni Suef Technological University – BTU
October 6, 2026
•[ ransomware, education, technology ]
Beni Suef Technological University BTU was listed as a victim on the leak site of the UmBra ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: Egypt. Beni Suef Technological University (BTU) is Egypts first technological university, offering industry-focused programs in ICT, Mechatronics, Renewable Energy, Autotronics, Railway Technology, and other applied technology fields, with international cooperation and ABEEK-accredited programs.
Westrop Primary & Nursery School
October 2, 2026
•[ ransomware, education ]
Westrop Primary & Nursery School was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: westropprimaryschool.co.uk. westropprimaryschool.co.uk Westrop Primary & Nursery School is a state-funded community school in Highworth, Swindon (Wiltshire, UK), founded in 1969, serving children aged 211. It currently has ~380 enrolled students (capacity 495), with 18.6% on free school meals and 16.3% on SEN support. The school employs ~47 staff (15 teachers + 32 teaching assistants, 20:1 student-teacher ratio) under Headteacher Cindy Acres (since 2018). Annual income is approximately 2 million (~5,461 per pupil), with a healthy 75K surplus and ~100K reserves. Rated "Good" by Ofsted (October 2022, maintained since 2012), though 2024/25 exam results showed weaker math progress and 0% at higher standards compared to strong 2018/19 performance. It runs 11 primary classes plus a three-room nursery and is known for its Forest School program and strong pupil premium support.
Philander Smith University
October 6, 2026
•[ ransomware, education, financial ]
Philander Smith University was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: United States of America. Website: philander.edu. Revenue: $25.3 million annual
Philander Smith University is a private, historically Black liberal arts institution in Little Rock, Arkansas, founded in 1877 and affiliated with the United Methodist Church. They provide undergraduate and graduate education with a focus on academic excellence, social justice, and leadership development for a diverse student body. We successfully exfiltrated 500GB+ worth of data which includes VERY confidential information about students and staff, as well as financial information. Alongside, we have encrypted files across the entire network.
University of Rostock
October 7, 2026
•[ ransomware, education ]
University of Rostock was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-10-07. Sector: Education. Country: Germany. The University of Rostock, founded in 1419, is the oldest university in the Baltic Sea region, offering over 140 diverse study programs across various fields. It focuses on innovative research and interdisciplinary collaboration to address contemporary societal challenges. The university welcomes students and staff from around the world, promoting a family-friendly and inclusive environment. It also emphasizes democratic values and the importance of free academic exchange.
Shalom Christian Academy
October 9, 2026
•[ ransomware, education, leak ]
Shalom Christian Academy was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Education. Country: United States of America. Website: shalomca.com. As a school, Shalom Christian Academy is legally and ethically obligated to maintain a wide range of confidential information. However, they are grossly negligent in protecting their own security and that of their students and staff. Consequently, we provide you with student grades, disciplinary and special education records, health and immunization records, financial aid and tuition information, donation history, employee background checks, salary data, and internal security documents. This leak into the public domain constitutes an unacceptable betrayal that can lead to identity theft, financial fraud, extortion, harassment, and devastating harm to children and families. The school is culpable for this act and must be held accountable to the fullest extent of the law.
Ansonia Public Schools
October 6, 2026
•[ ransomware, education ]
Ansonia Public Schools was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: United States of America. Website: ansonia.org. ansonia.org zoominfo.com/c/ansonia-public-schools/6671532 Ansonia Public Schools is a public PK12 school district in Ansonia, Connecticut (Naugatuck Valley), serving ~2,3322,404 students across 4 schools with 166 teachers (14.5:1 ratio, avg salary $99K) under Superintendent Dr. Joseph DiBacco. Annual BOE budget is $39.5M (2026-27), spending $19,869 per pupil ($2,185 below CT state average), funded 54% by state aid, 34% local property taxes, and 13% federal. The district faces severe academic challenges: math proficiency at just 1215% (state: 41%) and reading at 2425% (state: 51%), ranking it in the bottom 50% of Connecticut districts (1/10 rating). Demographics are high-need 80% minority enrollment, 63.6% on free/reduced meals, and 23.1% chronic absenteeism. Graduation rate is 85.7% (state: 88.9%), with strong positives in college-prep course-taking (95.7%) and on-track graduation (92.5%). Financially fragile: the city has been a "distressed municipality" since 2010, fund balance
