Onslow County Schools
June 9, 2026
•[ hack, education, technology ]
Onslow County Schools detected unauthorized criminal activity within its technology infrastructure during the early morning of June 9, 2026. The incident caused districtwide phone and internet outages, disrupted end-of-course retesting, and affected planned graduation livestreams. District technology staff took protective action and worked with local, state, and federal law enforcement, including the FBI and U.S. Secret Service. The actor, method, motive, and full restoration time were not disclosed.
Reynella East College
June 9, 2026
•[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
Illinois Central College
June 15, 2026
•[ hack, leak, education ]
ShinyHunters claimed on June 15, 2026 that it stole more than 28 GB from Illinois Central College systems including PeopleSoft Campus Solutions, human-resources, pension-reporting, Workday-costing, and curriculum systems. DataBreach.com later indexed 21,190 rows from the leak. The college had not publicly confirmed the actor's full claimed scope, and no encryption or operational disruption was documented.
Houston City College
June 15, 2026
•[ hack, leak, education ]
ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
Glendale Community College
June 15, 2026
•[ ransomware, education, leak ]
ShinyHunters claimed a pay-or-leak breach of Glendale Community College dated 15 June and later published attributed data. The college said it was notified of a potential incident on 16 June, isolated and secured its network, and determined that certain student educational-record data may have been copied without authorization. The isolation was a defensive containment measure; no service outage or attacker-caused operational disruption was reported. The initial access method was not disclosed.
Mount Royal University
June 17, 2026
•[ ransomware, education ]
Mount Royal University identified the incident on June 17. The actor copied and deleted specific H-drive folders and deleted the departmental J drive, disrupting university services. CMD Organization claimed 10 TB and demanded 30 bitcoin, but the volume was not verified. MRU later said it had reason to believe the obtained information had been deleted and was no longer held by those responsible; restoration remained underway August 10.
Salida School District R-32-J
June 29, 2026
•[ ransomware, education ]
Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
Sumner County Schools
July 20, 2026
•[ hack, education, technology ]
On July 20, 2026, Sumner County Schools discovered unauthorized access to its network. The incident disrupted network communications and back-to-school preparations, causing the district to postpone registration from July 22 to August 4-5 and move the first day of classes from August 4 to August 10. The district restored core network communications before announcing recovery on July 31. It reported that Skyward, school nutrition, payroll, student iPads and Chromebooks, and scheduled sports were unaffected. The FBI, Tennessee Bureau of Investigation, Department of Homeland Security, Tennessee Department of Education, and outside forensic specialists assisted. The district had not identified an actor, attack method, ransom demand, encryption, or compromised student or employee data.
Oceanside Unified School District
July 24, 2026
•[ hack, education, technology ]
District communications confirmed a network disruption and unavailable services while forensic specialists investigated and restored systems. Internal sources said containment had been underway since July 24, 2026; that date is an onset/response proxy, not a verified intrusion date. The superintendent identified email, internet, Google Drive and ClassLink-related outages. Staff suspicions of database extraction were not confirmed. The attacker, motive, encryption status and recovery completion remain undisclosed.
French Ministry of National Education (staff-training information system)
July 25, 2026
•[ leak, government, education ]
On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
Académie de Créteil
July 25, 2026
•[ hack, leak, government ]
France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
Newton County School System
July 27, 2026
•[ hack, education ]
Newton County Schools identified unauthorized access to its digital network on July 27, 2026 and took affected systems offline. Email and other network services remained unavailable on July 31, while staff used paper alternatives for student schedules. Schools opened August 3 as scheduled and network services were restored August 6 after nine days, although the district said on August 11 that restoration of some applications and software continued. No actor, ransom demand, malware family, motive, or confirmed data theft was identified.
United Kingdom Department for Education
July 29, 2026
•[ leak, government, education ]
ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
Undisclosed South Korean educational website owner or operator
July 30, 2026
•[ espionage, hack, education ]
An unnamed state-sponsored group compromised at least one South Korean educational website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the education sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Southeastern Oklahoma State University
July 30, 2026
•[ ransomware, leak, education ]
A cybersecurity incident beginning July 30, 2026 caused Southeastern Oklahoma State University to take some systems offline and close its Durant campus on July 30, July 31, and August 3. The university later confirmed that an unauthorized actor accessed some computer systems and may have acquired files. Interlock subsequently claimed 710 GB containing 171,499 files and 19,366 folders, and DataBreach.com indexed 582,315 leaked rows.
Advanced Procurement for Universities and Colleges
July 31, 2026
•[ hack, social, education ]
Advanced Procurement for Universities and Colleges confirmed that an unauthorized party accessed historical data in mid-July 2026. APUC said it contained the incident immediately, experienced no operational disruption, and notified relevant authorities. Sources reported an extortion demand and claimed administrator access through an employee account and theft of 20 years of data, but those details were not confirmed; no responsible group was publicly identified.
Anna's Archive
August 1, 2026
•[ hack, technology, education ]
Shadow library Anna's Archive suffered prolonged outages in August 2026 that it attributed to a coordinated, targeted network attack by an unidentified group. The site recovered, said it took steps to address the attack and credited members extra days for the downtime.
Mathspace
August 10, 2026
•[ leak, technology, education ]
Sydney-based maths learning platform Mathspace said an attacker exploited an unpatched Metabase flaw from 10 Aug 2026 and on 27 Aug downloaded records of 1,079,819 students, parents, teachers and staff in Australia and NZ. Regulators were notified; no passwords were taken.
Sogang University
August 11, 2026
•[ hack, brute-force, education ]
An unidentified external attacker accessed Sogang University's integrated login system from an unauthorized overseas IP address on August 11, 2026 using brute-force activity. The university detected the incident on August 14 and confirmed that approximately 180,000 records relating to students, alumni, former students, staff, and other account holders were leaked.
Town of Andover
August 13, 2026
•[ ransomware, government, education ]
A cyberattack detected August 13 caused a four-day outage across the shared Town of Andover and Andover Public Schools network, disrupting internet connectivity, external email, online bill payments, and access to school teacher assignments while public safety agencies and utilities remained operational. Wallstreet subsequently listed Andover on its leak site and claimed possession of documents, databases, email, personal data, and media. The town has not confirmed Wallstreet's responsibility or any data theft, so the claimed exfiltration is not coded as an exploitive primary effect.
