Education Ransomware Victims & Data Breaches

BREACH HOUSE ALERTS
Get an alert whenever a new Education organisation is listed
Narrow it to specific countries — and pick which feeds to watch — in the next step.

Breach House is tracking 1119 organizations in the Education sector named by ransomware and data-extortion groups, with activity recorded as recently as September 2026. Each listing links to a full intelligence profile with the attributed threat actor, discovery date and source.

Most active ransomware groups targeting Education

lockbit3 92 qilin 73 incransom 57 vicesociety 52 interlock 48 rhysida 44 medusa 40 pysa 40

Top countries for Education attacks

United States 457 United Kingdom 67 France 32 Germany 30 Canada 30 Australia 22 India 17 Brazil 17

Education Victims Page 2 / 12

Type Target Source Discovered Country Intel Link
Ransomware bergen1.net View Details incransom United States
Ransomware Don Bosco Technical Institute of Makati View Details nova Philippines
Ransomware Australian College of Business Intelligence View Details qilin Australia
Ransomware Tower View Primary School View Details rhysida United Kingdom
Ransomware PowerCampus View Details shadowbyt3$ India
Ransomware Stride Learning View Details ShadowByt3$ United States
Ransomware University Of Georgia View Details ShadowByt3$ United States
Ransomware Gorey Community School View Details payload Ireland
Ransomware dentoncalvary.org View Details lockbit5 United States
Ransomware st-annes.uk.com View Details lynx United Kingdom
Ransomware Houghton Mifflin Harcourt Company View Details shinyhunters United States
Ransomware Colegio Notre Dame Campinas View Details thegentlemen Brazil
Ransomware Beaconhouse School System View Details thegentlemen Pakistan
Ransomware Desert Christian Schools (DCS) View Details Bavacai United States
Ransomware Académie de Montpellier / CSJM View Details Bavacai France
Ransomware Académie de Montpellier / CSJM View Details medusalocker France
Ransomware Colegio María Inmaculada (CMI) View Details Bavacai Costa Rica
Ransomware Colegio María Inmaculada (CMI) View Details medusalocker Costa Rica
Ransomware Instructure Holdings, Inc. (Canva LMS, instructure.com) View Details shinyhunters United States
Ransomware Follett Software LLC View Details shinyhunters United States
Ransomware Blanchard View Details payoutsking United States
Ransomware Eduporium View Details qilin United States
Ransomware certifiedinfosec.com View Details apt73 United States
Ransomware mahidol.ac.th View Details apt73 Thailand
Ransomware bg.ac.rs View Details apt73 Serbia
Ransomware alx-pc.com View Details apt73 Germany
Ransomware St Stephens International View Details thegentlemen United Kingdom
Ransomware Udemy, Inc. (udemy.com) View Details shinyhunters United States
Ransomware Roman Catholic Archdiocese of St John View Details qilin Canada
Ransomware st-bernards.bham.sch.uk View Details safepay United Kingdom
Ransomware Qatar Biomedical Research Institute (QBRI) View Details crypto24 Qatar
Ransomware Franziskusschule Wilhelmshaven View Details payload Germany
Ransomware Uniwersytet Warszawski View Details interlock Poland
Ransomware Uniwersytet Warszawski View Details interlock Poland
Ransomware UOM University View Details coinbasecartel Malta
Ransomware La Maison Bleue France View Details coinbasecartel France
Ransomware zsfh.cz View Details lockbit5 Czechia
Ransomware McGraw Hill, Inc. (mheducation.com) View Details shinyhunters United States
Ransomware www.campbell.edu View Details incransom United States
Ransomware Win Academy View Details thegentlemen India
Ransomware CCCKeito.edu.hk View Details krybit Hong Kong
Ransomware UNIV LILLE View Details lapsus$ France
Ransomware lkc.ac.bw View Details krybit Botswana
Ransomware Community College of Beaver County View Details interlock United States
Ransomware Community College of Beaver County View Details interlock United States
Ransomware The Center for Hearing & Speech View Details interlock United States
Ransomware fhw-neukoelln.de View Details dragonforce Germany
Ransomware Alamo Heights School District View Details worldleaks United States
Ransomware Notre-Dame du Grandchamp View Details nightspire France
Ransomware Catalyst Learning Company View Details genesis United States
Ransomware San Felipe Del Rio CISD School View Details worldleaks United States
Ransomware giunti.it View Details lockbit5 Italy
Ransomware webster-schools.org View Details lockbit5 United States
Ransomware alcornschools.org View Details lockbit5 United States
Ransomware senai.br View Details lockbit5 Brazil
Ransomware IBB Institut für Bildung und Beratung View Details qilin Germany
Ransomware Monmouth University View Details pear United States
Ransomware jenningsk12.org View Details incransom United States
Ransomware Marion Military Institute View Details worldleaks United States
Ransomware Infinite Campus, Inc. View Details shinyhunters United States
Ransomware Amerinational Management Services (AMS) View Details sinobi United States
Ransomware Cortporation Colina View Details thegentlemen Chile
Ransomware Payap University View Details thegentlemen Thailand
Ransomware Private University View Details pear United States
Ransomware Trinity Catholic High School View Details beast United States
Ransomware Tamir Hayman View Details handala Israel
Ransomware Hebrew University of Jerusalem View Details handala Israel
Ransomware St Fabian Catholic View Details thegentlemen United States
Ransomware Raz Zimmt (head of the Iran Desk at Israeli security institutes) View Details handala Israel
Ransomware Stryker Corporation View Details handala United States
Ransomware Big Brothers Big Sisters View Details nightspire United States
Ransomware Institute of Social Security - Paraguay View Details kairos Paraguay
Ransomware Salford City College View Details qilin United Kingdom
Ransomware Wagon Mound Public Schools View Details interlock United States
Ransomware Wagon Mound Public Schools View Details interlock United States
Ransomware salfordcc.ac.uk View Details dragonforce United Kingdom
Ransomware Israel Institute for National Security Studies (INSS) View Details handala Israel
Ransomware CHS Villach View Details thegentlemen Austria
Ransomware denmark.k12.wi.us View Details incransom United States
Ransomware Adidas View Details lapsus$ Germany
Ransomware Lille University View Details lapsus$ France
Ransomware American Beauty School View Details akira United States
Ransomware Birmingham Museum of Art View Details termite United States
Ransomware University of Pennsylvania View Details shinyhunters United States
Ransomware Harvard University View Details shinyhunters United States
Ransomware Sasin Colleges & Universities View Details thegentlemen Thailand
Ransomware University of Mannheim View Details qilin Germany
Ransomware Archaeological Institute of America View Details interlock United States
Ransomware Thammasat University View Details thegentlemen Thailand
Ransomware Fgf Colleges & Universities View Details thegentlemen Brazil
Ransomware L'Aeroclub View Details thegentlemen France
Ransomware University of Applied Sciences,Worms View Details qilin Germany
Ransomware Lakeside Union School District View Details rhysida United States
Ransomware Medinah School District 11 View Details qilin United States
Ransomware Odyssey Academy View Details interlock United States
Ransomware Odyssey Academy View Details interlock United States
Ransomware EduPro University Group View Details 0apt —
Ransomware all Data View Details tengu —
Ransomware Summit Education Trust View Details 0apt South Africa
Ransomware Ruskin College View Details beast United Kingdom

Explore other industry sectors

Other 7214 Communication / Marketing 5001 Services 2891 Finance / Legal / Insurance 2670 Manufacturing / Engineering 2353 Healthcare / Pharma 2009 IT 1852 Public Sector 1646 Construction / Real Estate 1326 Retail / E-commerce 900 Transportation / Travel / Logistics 807 Energy 749 All sectors →