🎓 Education

Schools, universities, edtech · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D5▼ −1

Prior 30D6

Active actor L90DUnknown · 4

Active actor L90DThe Gentlemen · 2

Active actor L90DBooba · 1

Today — 03 Nov 2026

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days

University of Copenhagen test environment breach exposes 525,000 people's national ID numbers — a missed catch-up now on file, company-confirmed and corroborated across multiple outlets.HighEducationHackers accessed a test environment on or before Oct 20 that, contrary to its name, held real personal data: full names, Danish CPR national ID numbers, phone numbers and emails for roughly 525,000 people, plus ID-card PINs for about 20,000 staff and students. The university detected the intrusion Oct 20, disclosed Oct 23, temporarily restricted access to select campus buildings as a precaution, reissued the affected PINs, then reopened. Reported to Datatilsynet (the Danish data-protection authority); no actor has claimed responsibility. One low-quality single source claims a second intrusion forced an administrative-systems shutdown Oct 26 — not corroborated elsewhere, not treated as fact. Infosecurity Magazine · The Copenhagen Post

Richmond Public Schools (Virginia) remains offline district-wide after a cybersecurity incident, ransomware status unconfirmed.HighEducationAll 53 campuses lost internet access Oct 21, disrupting phones, email, Wi-Fi, cameras and the PowerSchool portal; outside cybersecurity experts are assisting restoration. The district has not confirmed encryption, data exfiltration, or a ransomware attribution. A Cybernews report of ransom notes appearing on staff laptops with a 72-hour leak deadline is unverified — no group has claimed responsibility and the district has not confirmed it. WRIC-TV · Hoodline

Educational Testing Service tells California it lost control of student records stretching back to 2006 after an unauthorized party used a compromised login to copy files from an ETS-run file-transfer site between May 22 and Sep 18 — a government-notified catch-up this desk missed.HighEducationNames, state student ID numbers, dates of birth, addresses and demographic data for current and former California public-school students are affected; ETS disabled the account, rebuilt the transfer site, and says it has found no evidence the data has surfaced publicly. Notification letters began Oct 16. Company-confirmed via the state. California Department of Education

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 23 University of Copenhagen Unknown Ransomware · higher education · Denmark Hackers breached a test environment holding real personal data (not synthetic test records): full names, Danish CPR national ID numbers, phone numbers and emails for roughly 525,000 people, plus ID-card PINs for about 20,000 staff/students. Detected Oct 20, disclosed Oct 23; the university temporarily restricted access to select campus buildings and reissued affected PIN codes, then reopened. Reported to Datatilsynet (Danish DPA). No actor has claimed responsibility. · Sources: Infosecurity Magazine · The Copenhagen Post

Oct 21 Richmond Public Schools Unknown Ransomware · education · USA District-wide internet shutdown across 53 campuses since Oct 21 disrupting phones, email, Wi-Fi, cameras and the PowerSchool portal; outside cybersecurity experts assisting restoration. District has not confirmed encryption or data exfiltration, or whether this is ransomware. Cybernews separately reported ransom notes appeared on staff laptops threatening a 72-hour leak deadline -- unverified, no group has claimed responsibility and the district has not confirmed it. · Sources: WRIC-TV · Hoodline

Oct 16 Educational Testing Service (California student data) Unknown Ransomware · education · USA ETS, which runs California's statewide student assessments under contract with the California Department of Education, says an unauthorized party used a compromised login credential to copy files from an ETS-operated secure file-transfer site between May 22 and Sep 18, 2026; unauthorized activity identified Sep 25. Data includes student names, Statewide Student IDs, dates of birth, addresses and demographic information for current and former California public-school students (enrollment records back to 2006). ETS has found no evidence the data has been made public; notification letters began Oct 16. · Sources: CDE news release

Oct 06 University of Illinois Chicago (College of Medicine) Booba Ransomware · education · United States UIC disclosed unauthorized actors obtained data from College of Medicine servers; main network and UI Health patient care were not affected, and affected systems have been restored. The Booba ransomware gang claims responsibility and claims 344GB exfiltrated; one analyst suggests Booba may be a Frag ransomware rebrand, unconfirmed. · Sources: The Record

Oct 05 Osaka Metropolitan University Unattributed Breach · education · Japan Suspected ransomware attack took down ~500 servers starting ~Oct 2; backups reportedly also encrypted. Data of 130,000+ students and staff potentially exposed; no confirmed leak yet. Classes canceled through ~Oct 8, resumed in-person Oct 9. · Sources: Nippon.com

Oct 03 Westrop Primary & Nursery School The Gentlemen Ransomware · Education · UK Swindon-area state primary school (~380 pupils). Unverified DLS claim, est. attack Oct 2. · Sources: Ransomware.live · DeXpose

September 2026

Sep 30 VUS - The English Center The Gentlemen Ransomware · Education · Vietnam Vietnam USA Society English-language education network (70+ centers, 250,000+ students/year) listed on The Gentlemen's leak site; estimated attack date Sep 29; no company confirmation. · Sources: Ransomware.live · GalaxyWarden

Sep 28 St James' Anglican School ThreeAM Ransomware · Education · Australia Alkimos, Western Australia K-12 school; disclosed a cyber incident Sep 14 (unauthorized access, personal info of school community involved) without an attacker claim; ThreeAM claimed responsibility Sep 28 on its leak site, saying data 'will be available soon' but has not published or proven data; no company confirmation of ThreeAM's specific claim. · Sources: Cyber Daily · DeXpose

Sep 17 Universität Hamburg Panzer Ransomware · Education · Germany Panzer, a new RaaS brand active since Aug 5 2026 (16+ claimed victims across 11 countries), listed Universitat Hamburg -- Northern Germany's largest research and educational institution, 42,000+ students -- on its leak site Sep 17. No data volume or scope disclosed, no university confirmation. DLS claim only. · Sources: RedPacket Security · Ransomware.live

Sep 16 Odyssey Charter School Wallstreet Ransomware · Education · USA Wallstreet, a cyber-extortion group active since early 2026, listed Odyssey Charter School (a Florida nonprofit operator of tuition-free K-12 public charter schools) on its leak site Sep 16. The listing does not specify whether systems were encrypted or data exfiltrated, and carries no ransom demand or data sample. No school confirmation. DLS claim only. · Sources: HackNotice

Sep 08 Mathspace Unknown Ransomware · Education · Australia Unauthorized access to internal Metabase reporting system (SQLi in unpatched Metabase instance) exposed names, emails, usernames and account metadata for 1,079,819 students, parents and staff across Australia and New Zealand; no passwords, academic records or API credentials taken. Fourth confirmed victim of the same unpatched-Metabase pattern after Framework, Tally and Kilo Code in August. · Sources: https://www.helpnetsecurity.com/2026/09/08/mathspace-data-breach-metabase-vulnerability/ · https://www.bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people/

July 2026

Jul 31 Southeastern Oklahoma State University Interlock Ransomware · Education · USA Interlock ransomware attack on public university in Durant OK; confidential financial records including unaudited earnings reports and tax files stolen; campus closed 3 days; 42,000 students locked out; DLS claim posted Aug 19 2026 · Sources: https://www.kxii.com/video/2026/08/03/southeastern-oklahoma-state-university-reopen-tuesday-after-cybersecurity-incident/

Jul 20 TimeTEX GmbH SafePay Ransomware · education · Germany German educational supplies company; SafePay DLS claim July 20, 2026; part of coordinated 7-victim Germany spree on same date; data scope and impact unconfirmed; 🟥 unverified · Sources: DeXpose

Jul 14 Cedar Crest College NightSpire Ransomware · Education · USA Liberal arts college in Allentown PA listed on NightSpire DLS July 14. Estimated attack date July 13. No public statement from Cedar Crest College. · Sources: https://ransomware.live/group/nightspire

June 2026

Jun 29 Musashino University Qilin Ransomware · education · Japan Qilin DLS claim June 29, 2026; data scope and impact unconfirmed; previously uncaptured; 🟥 unverified · https://www.redpacketsecurity.com/qilin-ransomware-victim-musashino-university/ · Sources: [RedPacket Security]

Jun 26 911 Driving School PrinzEugen Ransomware · education · driving instruction/US national driving school chain; PrinzEugen DLS claim June 26, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.breachsense.com/breaches/2026/june/ · Sources: [Breachsense]

Jun 25 San Silvestre School Krybit Ransomware · education · Peru 148.75 GB claimed; 🟥 unverified — possible re-listing of prior Qilin-targeted school; treat as claimed only pending victim statement · https://x.com/FalconFeedsio/status/2070123961552371874 · Sources: [FalconFeeds]

Jun 23 Reynella East College Interlock Ransomware · education · Australia all IT systems offline; 1,900+ students and staff at risk; school disclosed breach June 9 in letter to parents; Interlock DLS claim posted June 23; investigation ongoing, data exposure unconfirmed · https://www.cyberdaily.au/security/13731-parents-warned-after-cyber-security-breach-at-south-australia-s-reynella-east-college · https://www.ransomware.live/ · Sources: [Cyber Daily] · [ransomware.live]

Jun 20 BITS Pilani DragonForce Ransomware · higher education · India https://www.redpacketsecurity.com/dragonforce-ransomware-victim-bits-pilani-ac-in/ · https://www.ransomware.live/group/dragonforce · Sources: [RedPacket Security] · [ransomware.live]

Jun 16 Moody Bible Institute ShinyHunters Extortion · education · US 1,300+ files claimed; group alleged "tens of millions of records" related to enrollment, donor relations, payroll, and communications; Oracle PeopleSoft CVE-2026-35273 attack vector; DLS claim June 16, 2026; scope unverified; law firm class action investigation underway — 🟥 unverified · https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit · https://www.classaction.org/data-breach-lawsuits/moody-bible-institute-june-2026 · Sources: [Google Cloud Blog] · [classaction.org]

Jun 15 Glendale Community College ShinyHunters Extortion · education · US 62GB exfiltrated (304,000+ files); Oracle PeopleSoft Campus Solutions compromised via CVE-2026-35273; 150,000+ student records including names, DOBs, student emails, enrollment, financial aid, and transcript data (Sept 2020–June 2026); DLS claim June 15–16, 2026; final ransom warning before June 18 deadline · https://www.ransomware.live/id/Z2xlbmRhbGUuZWR1QHNoaW55aHVudGVycw · https://www.redpacketsecurity.com/shinyhunters-ransomware-victim-glendale-edu/ · https://cybernews.com/security/google-shinyhunters-oracle-peoplesoft-zero-day-extortion/ · Sources: [ransomware.live] · [RedPacket Security] · [Cybernews]

Jun 15 Illinois Central College ShinyHunters Extortion · education · US 28GB data claimed; Oracle PeopleSoft CVE-2026-35273 attack vector; DLS claim June 15, 2026; final ransom warning issued · https://www.dexpose.io/shinyhunters-breach-illinois-central-college/ · https://www.breachsense.com/breaches/illinois-central-college-data-breach/ · Sources: [DeXpose] · [Breachsense]

Jun 11 Colégio Santo Inácio LockBit Ransomware · education · Brazil Sources: FalconFeeds

Jun 10 Global Schools Foundation FulcrumSec Ransomware · education · Singapore Sources: ransomware.live DLS

Jun 09 University of Nottingham ShinyHunters Extortion · education · UK 454,600+ student and alumni records including names, addresses, phone numbers, passport numbers, ethnicity and disability data, and academic records; Oracle PeopleSoft CVE-2026-35273 confirmed access vector (attack window May 27–June 9); university confirmed incident June 11, 2026 · https://www.bleepingcomputer.com/news/security/nottingham-university-data-breach-affects-over-450-000-students/ · https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-raids-nottingham-uni-for-student-alumni-data/5253961 · https://www.helpnetsecurity.com/2026/06/11/oracle-peoplesoft-under-attack-cve-2026-35273/ · Sources: [BleepingComputer] · [The Register] · [Help Net Security]

Jun 09 Houston City College ShinyHunters Extortion · education · US Oracle PeopleSoft CVE-2026-35273 attack vector; DLS claim first posted June 9 onwards; named victim confirmed in Google Cloud/Mandiant ShinyHunters education sector campaign report (June 2026) · https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit · https://www.highereddive.com/news/colleges-hit-in-cyberattack-by-group-behind-canvas-breach-google-says/822831/ · Sources: [Google Cloud Blog] · [Higher Ed Dive]

Jun 08 Kinetic Education Qilin Ransomware · education · Australia Sources: ransomware.live DLS

Jun 01 School Facility Consultants Abyss Ransomware · education planning and consulting · US California-based firm advising school districts on facility planning, project management, and construction; Abyss DLS claim June 1, 2026; sensitive information threatened for release; scope unconfirmed · https://www.dexpose.io/abyss-ransomware-targets-school-facility-consultants/ · https://www.hookphish.com/blog/ransomware-group-abyss-hits-school-facility-consultants/ · Sources: [DeXpose] · [HookPhish]

May 2026

May 15 Krum Public Library NightSpire Ransomware · education-library · US 50 GB claimed exfiltrated: financial docs, HR data, supervisor info; attack May 14 2026; city of Krum confirmed ransomware in June 3 public notice; no SSNs/financial account info compromised; backups prevented permanent data loss; 🟨 city-confirmed · https://dysruptionhub.com/krum-library-ransomware-wifi/ · https://www.ransomware.live/id/S3J1bSBQdWJsaWMgTGlicmFyeUBuaWdodHNwaXJl · Sources: [Dysruption Hub] · [ransomware.live]

April 2026

Apr 25 Instructure/Canvas ShinyHunters Extortion · education technology platform · US 275 million users across 8,809 universities, educational ministries, and institutions worldwide; attack April 25, 2026; Instructure detected intrusion April 29 and revoked access; disclosed May 1; data includes student names, email addresses, student ID numbers, and user messages; described as the largest educational data breach on record; Instructure paid ransom, "shred logs" provided May 11; FBI warned students and staff of ongoing phishing risk post-ransom · https://www.malwarebytes.com/blog/news/2026/05/millions-of-students-personal-data-stolen-in-major-education-cyberattack · https://www.bitdefender.com/en-us/blog/hotforsecurity/canvas-data-breach-2026 · Sources: [Malwarebytes] · [Bitdefender]

Apr 24 Udemy ShinyHunters Extortion · education technology · US 1.4 million records claimed; listed DLS April 24, data published April 27 after ransom deadline; no Udemy public confirmation — 🟥 unverified · Sources: [Cybernews] · [SC Media]

March 2026

Mar 18 Infinite Campus ShinyHunters Extortion · education technology · US student information system serving 3,200+ school districts and 11M students across 46 US states; Salesforce account vishing attack March 18, 2026; 137,123 unique school staff accounts' data exfiltrated: names, email addresses, phone numbers, physical addresses, job titles, usernames, and support tickets; Infinite Campus confirmed breach (staff data only; no evidence student databases compromised); HIBP notification June 15, 2026; Salesforce vector (not PeopleSoft CVE-2026-35273) · https://www.bleepingcomputer.com/news/security/infinite-campus-data-breach-affects-137-000-school-staff-accounts/ · https://cybernews.com/cybercrime/shinyhunters-data-infinite-campus-137k-students-exposed/ · https://www.techradar.com/pro/security/11-million-students-possibly-at-risk-after-classroom-software-used-by-millions-hacked · Sources: [BleepingComputer] · [Cybernews] · [TechRadar]

February 2026

Feb 24 Strategic Education Unattributed Breach · education · US incident 23–25 Feb 2026

---

← All industries · Victim database →